CVE-2026-45062: FrankenPHP remote code execution via unsafe Unicode handling in CGI path splitting

CVE-2026-45062 · Severity: high · CVSS 8.1 · Published 2026-06-10

FrankenPHP is a modern application server used to run PHP websites and applications. A security flaw in how it handles web addresses (URLs) containing special characters allows an attacker to trick the server into running non-PHP files as if they were PHP scripts. If an attacker can upload or place a file on the server—such as a text file or an image containing malicious code—they can use this vulnerability to take control of the server and execute unauthorized commands.

Technologies: github.com/dunglas/frankenphp (Go). Vendors: Go.

Quick answers

Is CVE-2026-45062 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45062 being exploited in the wild.
How severe is CVE-2026-45062?
High severity, with a CVSS score of 8.1, published 10 June 2026.
Which products and versions are affected?
github.com/dunglas/frankenphp (Go) >= 1.11.2, <= 1.12.2, SEMVER:introduced=1.11.2,fixed=1.12.3; Kévin Dunglas FrankenPHP >= 1.11.2, <= 1.12.2, v1.11.2 to v1.12.2.
Is there a fix for CVE-2026-45062?
Yes. github.com/dunglas/frankenphp (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45062 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45062?
Check whether you run github.com/dunglas/frankenphp (Go) or Kévin Dunglas FrankenPHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/dunglas/frankenphp (Go): upgrade to 1.12.3 or later
    go get github.com/dunglas/frankenphp@v1.12.3

Technical details

A remote code execution vulnerability exists in FrankenPHP's CGI path splitting logic within `cgi.go`. The `splitPos()` function incorrectly utilizes the `golang.org/x/text/search` library with `search.IgnoreCase` when encountering non-ASCII bytes in a request path. This leads to two issues: a control-flow flaw where a 'match' state remains true after a failed non-ASCII fallback, and a Unicode equivalence flaw where various Unicode lookalikes (e.g., mathematical bold or circled characters) are normalized to '.php'. An unauthenticated attacker who can upload or influence filenames on the server can bypass extension restrictions to execute arbitrary code. The vulnerability is reachable over the network and has been addressed in version 1.12.3 by removing the complex Unicode search fallback in favor of strict ASCII byte matching.

Affected products

  • dunglas FrankenPHP v1.11.2 to v1.12.2

Identifiers

  • CVE-2026-45062
  • GHSA-3g8v-8r37-cgjm
  • GO-2026-5084

Timeline

  • 2026-05-15: patched: Version 1.12.3 released
  • 2026-06-10: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.