# CVE-2026-45062: FrankenPHP remote code execution via unsafe Unicode handling in CGI path splitting

Source: https://junglewise.ai/threats/cve-2026-45062-frankenphp-remote-code-execution-via-unsafe-unicode-handling-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45062 · Severity: high · CVSS 8.1 · Published 2026-06-10

FrankenPHP is a modern application server used to run PHP websites and applications. A security flaw in how it handles web addresses (URLs) containing special characters allows an attacker to trick the server into running non-PHP files as if they were PHP scripts. If an attacker can upload or place a file on the server—such as a text file or an image containing malicious code—they can use this vulnerability to take control of the server and execute unauthorized commands.

Technologies: [github.com/dunglas/frankenphp (Go)](https://junglewise.ai/threats/technologies/github-com-dunglas-frankenphp). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-45062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45062 being exploited in the wild.

**How severe is CVE-2026-45062?** High severity, with a CVSS score of 8.1, published 10 June 2026.

**Which products and versions are affected?** github.com/dunglas/frankenphp (Go) >= 1.11.2, <= 1.12.2, SEMVER:introduced=1.11.2,fixed=1.12.3; Kévin Dunglas FrankenPHP >= 1.11.2, <= 1.12.2, v1.11.2 to v1.12.2.

**Is there a fix for CVE-2026-45062?** Yes. github.com/dunglas/frankenphp (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45062 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45062?** Check whether you run github.com/dunglas/frankenphp (Go) or Kévin Dunglas FrankenPHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dunglas/frankenphp (Go): upgrade to 1.12.3 or later

  ```sh
  go get github.com/dunglas/frankenphp@v1.12.3
  ```


## Technical details

A remote code execution vulnerability exists in FrankenPHP's CGI path splitting logic within `cgi.go`. The `splitPos()` function incorrectly utilizes the `golang.org/x/text/search` library with `search.IgnoreCase` when encountering non-ASCII bytes in a request path. This leads to two issues: a control-flow flaw where a 'match' state remains true after a failed non-ASCII fallback, and a Unicode equivalence flaw where various Unicode lookalikes (e.g., mathematical bold or circled characters) are normalized to '.php'. An unauthenticated attacker who can upload or influence filenames on the server can bypass extension restrictions to execute arbitrary code. The vulnerability is reachable over the network and has been addressed in version 1.12.3 by removing the complex Unicode search fallback in favor of strict ASCII byte matching.

## Affected products

- dunglas FrankenPHP v1.11.2 to v1.12.2

## Identifiers

- CVE-2026-45062
- GHSA-3g8v-8r37-cgjm
- GO-2026-5084

## Timeline

- 2026-05-15: patched: Version 1.12.3 released
- 2026-06-10: disclosed: Public advisory published

## References

- [https://github.com/php/frankenphp/releases/tag/v1.12.3](https://github.com/php/frankenphp/releases/tag/v1.12.3)
- [https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm](https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm)

## Related threats

- [FrankenPHP cross-request session ID leak in worker mode](https://junglewise.ai/threats/cve-2026-82416-frankenphp-cross-request-php-session-id-leak-in-worker-mode-when)
- [GO-2026-4442 - FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp](https://junglewise.ai/threats/go-2026-4442-frankenphp-has-delayed-propagation-of-security-fixes-in-2df5a458)
- [GO-2026-4486 - FrankenPHP's unicode case-folding length expansion causes incorrect split_path index…](https://junglewise.ai/threats/cve-2026-24895-frankenphp-s-unicode-case-folding-length-expansion-causes)
- [GO-2026-4489 - FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp](https://junglewise.ai/threats/cve-2026-24894-frankenphp-leaks-session-data-between-requests-in-worker-mode)
- [FrankenPHP has delayed propagation of security fixes in upstream base images](https://junglewise.ai/threats/frankenphp-has-delayed-propagation-of-security-fixes-in-upstream-base-d650c732)