Vulnerability in Php Frankenphp
CVE-2026-24895
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased c…
EPSS: 0.000 (8.7th percentile) — read the EPSS interpretation.
Affected products
- Php Frankenphp — versions < 1.11.2
Weakness classification (CWE)
References
- https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 (x_refsource_CONFIRM)
- https://github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e (x_refsource_MISC)
- https://github.com/php/frankenphp/releases/tag/v1.11.2 (x_refsource_MISC)