CVE-2026-85733

Deferred Deferred - Pending Action

Information Disclosure in FrankenPHP Docker Images

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85733

EUVD

EUVD-2026-98915

Affected Vendors & Products

Vendor	Product	Version / Range
php	frankenphp	< 1.12.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

FrankenPHP Docker images before version 1.12.5 include a default index.php file that exposes phpinfo(). This diagnostic page reveals sensitive environment variables, PHP configuration, extensions, software versions, and system paths when served in production.

Detection Guidance

Check if the default /app/public/index.php file exists in your FrankenPHP Docker container and serves phpinfo(). Inspect the container logs or run: docker exec <container_name> ls -la /app/public/index.php. If present, accessing the file via HTTP may expose sensitive information.

Impact Analysis

Attackers could access the phpinfo() page to gather sensitive information like environment variables used for secrets, which may lead to further exploitation or unauthorized access to systems.

Compliance Impact

This vulnerability may violate GDPR or HIPAA by exposing personal or health data through leaked environment variables or system paths, potentially leading to non-compliance with data protection requirements.

Mitigation Strategies

Upgrade to FrankenPHP version 1.12.5 or later. Replace the default /app/public/index.php with your application's entry point. Rebuild derived Docker images to ensure the placeholder is removed. Avoid exposing phpinfo() in production environments.

Hi! I’m here to help you understand CVE-2026-85733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70