{"id":"CVE-2026-24895","published":"2026-02-12T19:16:06Z","modified":"2026-02-12T20:04:07Z","title":"FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files","vendor":"PHP","product":"frankenphp","tier":"tail","description":{"text":"FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.9,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0065,"percentile":0.51026,"provenance":"source"},"cwes":[{"id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize"}],"references":[{"url":"https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e","tags":["x_refsource_MISC"]},{"url":"https://github.com/php/frankenphp/releases/tag/v1.11.2","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":10.21},{"name":"CVSS severity","points":6.23}]},"vendorSlug":"php","affectedVersions":[{"vendor":"php","product":"frankenphp","versions":["< 1.11.2"]}],"affected":[{"ecosystem":"Go","package":"github.com/dunglas/frankenphp","vulnerableRanges":["<1.11.2"],"patched":["1.11.2"],"from":["GHSA-g966-83w7-6w38","GO-2026-4486"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-6699","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-php-frankenphp-cve-2026-24895","children":[{"from":"CVE-2026-24895","to":"CVE-2026-27590","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-g966-83w7-6w38","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-5r3v-vc8m-m96g","via":"reference","url":"https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38"},{"kind":"osv-related","provenance":"source","id":"GO-2026-4536","via":"reference","url":"https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38"}]},{"from":"CVE-2026-24895","to":"CVE-2026-45135","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-m675-2p33-xv9g","via":"reference","url":"https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38"},{"kind":"osv-related","provenance":"source","id":"GO-2026-5492","via":"reference","url":"https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38"}]}],"packageHistory":[{"cve":"CVE-2026-24894","published":"2026-02-12","fixed":"1.11.2","kev":false},{"cve":"CVE-2026-24895","published":"2026-02-12","fixed":"1.11.2","kev":false},{"cve":"CVE-2026-45062","published":"2026-06-10","fixed":"1.12.3","kev":false,"link":{"from":"CVE-2026-24895","to":"CVE-2026-45062","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/dunglas/frankenphp","fromFixed":"1.11.2","toFixed":"1.12.3","daysApart":118}]}},{"cve":"CVE-2026-82416","published":"2026-10-13","fixed":"1.12.5","kev":false}],"package":"Go:github.com/dunglas/frankenphp"}}