Vulnerability GO-2026-5084
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:26 PM UTC
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
v1.11.2 - v1.12.2
v1.11.2 - v1.12.2
Summary
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
Details
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
High Risk
5 months ago
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
Unknown
8 months ago
FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
Unknown
8 months ago
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.11.1 GO-2026-4486
v1.0.0-beta.1 - v1.11.1 GO-2026-4486
Unknown
8 months ago
FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.11.1 GO-2026-4489
v1.0.0-beta.1 - v1.11.1 GO-2026-4489
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:26 PM UTC
Fixed (v1.12.3)
5 months ago
May 15, 2026 at 01:18 PM UTC
Last Modified
3 months ago
June 25, 2026 at 06:45 PM UTC