CVE-2026-45062 Details
Description
FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3.
A vulnerability in FrankenPHP versions 1.11.2 prior to 1.12.3 allows for remote code execution due to improper handling of Unicode characters in the CGI request path. The issue arises in the splitPos() function within cgi.go, where non-ASCII bytes can be exploited to mislead the server into executing non-PHP files as PHP scripts. This vulnerability can be exploited in environments where an attacker can upload files or manipulate file content, by crafting a URL that triggers the flaw. The vulnerability has been patched in version 1.12.3.
Users should upgrade to FrankenPHP version 1.12.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/php/frankenphp/releases/tag/v1.12.3 | [email protected] | Release NotesVendor |
| https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-176 | Improper Handling of Unicode Encoding | [email protected] |
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FrankenPHP | >= 1.11.2, < 1.12.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |