CVE-2026-24895

Katalog CVE

CVSS 9.8 · Critical EPSS 0,65%

Kerentanan Incorrect Behavior Order: Validate Before Canonicalize pada frankenphp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 exploit · advisory vendor
• https://github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e patch
• https://github.com/php/frankenphp/releases/tag/v1.11.2 release notes