CVE-2026-85733 Details

A vulnerability exists in the official FrankenPHP Docker images for Debian and Alpine, prior to version 1.12.5. These images include a default '/app/public/index.php' file that executes 'phpinfo()'. If a derived image does not overwrite this default, it will serve the 'phpinfo()' output in production, disclosing sensitive information such as environment variables, PHP configuration directives, loaded extensions, software versions, and system paths. This issue does not affect images built with a custom 'index.php' that replaces the default placeholder. The vulnerability is present in any image derived from the base FrankenPHP image that is deployed without a custom 'index.php' in the public directory.

Users can upgrade to FrankenPHP version 1.12.5 or later, where this issue is fixed. For images already built on a vulnerable base, it is necessary to rebuild the image or manually add a custom 'public/index.php' to remove the default 'phpinfo()' placeholder.