Executive brief
FrankenPHP is a modern application server used to run PHP websites and applications. A security flaw in how it handles web addresses (URLs) containing special characters allows an attacker to trick the server into running non-PHP files as if they were PHP scripts. If an attacker can upload or place a file on the server—such as a text file or an image containing malicious code—they can use this vulnerability to take control of the server and execute unauthorized commands.
Technical details
A remote code execution vulnerability exists in FrankenPHP's CGI path splitting logic within `cgi.go`. The `splitPos()` function incorrectly utilizes the `golang.org/x/text/search` library with `search.IgnoreCase` when encountering non-ASCII bytes in a request path. This leads to two issues: a control-flow flaw where a 'match' state remains true after a failed non-ASCII fallback, and a Unicode equivalence flaw where various Unicode lookalikes (e.g., mathematical bold or circled characters) are normalized to '.php'. An unauthenticated attacker who can upload or influence filenames on the server can bypass extension restrictions to execute arbitrary code. The vulnerability is reachable over the network and has been addressed in version 1.12.3 by removing the complex Unicode search fallback in favor of strict ASCII byte matching.
Affected products
- dunglas FrankenPHP v1.11.2 to v1.12.2
Timeline
- 2026-05-15: patched: Version 1.12.3 released
- 2026-06-10: disclosed: Public advisory published