Path Traversal in FrankenPHP Leading to RCE

Compliance Impact

CVE-2026-45062 allows an attacker to execute arbitrary code remotely by exploiting unsafe Unicode handling in FrankenPHP, potentially leading to a full compromise of the application server.

Such a compromise could result in unauthorized access to sensitive data, which may violate data protection regulations like GDPR or HIPAA if personal or protected health information is exposed or manipulated.

Therefore, organizations using affected versions of FrankenPHP without applying the patch risk non-compliance with these standards due to potential data breaches or loss of data integrity.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45062 is a vulnerability in FrankenPHP versions 1.11.2 to before 1.12.3 involving unsafe Unicode handling in the CGI path splitting function called splitPos().

The flaw arises from two issues: a control-flow error where a stale match variable remains true after encountering non-ASCII bytes, and Unicode equivalence problems caused by using search.IgnoreCase, which folds non-ASCII characters into ASCII equivalents.

These issues allow an attacker to trick FrankenPHP into treating non-.php files as .php scripts by crafting URLs with specific Unicode payloads, bypassing file extension checks.

If the attacker can place files on the server (e.g., via uploads or file storage), this can escalate to remote code execution without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts, including allowing an attacker to execute arbitrary code remotely on the FrankenPHP server.

An attacker who can upload or place files on the server can craft URLs that cause non-PHP files to be executed as PHP scripts, leading to full compromise of the FrankenPHP process.

The CVSS score of 8.1 (High) reflects the critical nature of this vulnerability, as it can lead to complete control over the affected application server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for requests containing URLs with crafted Unicode payloads that exploit the unsafe Unicode handling in the CGI path splitting function. Specifically, look for requests with file names using Unicode lookalike characters such as `shell﹒php` or `shell．php` which bypass normal .php extension checks.

On the system or network, detection involves inspecting web server logs or traffic for suspicious URL patterns that include non-ASCII characters in file extensions that should be .php files.

Example commands to detect such attempts could include using grep or similar tools to search logs for suspicious Unicode characters in URLs:

• grep -P '[\x{FF0E}\x{FF61}]php' /var/log/nginx/access.log
• grep -P '[．｡]php' /var/log/apache2/access.log

These commands search for Unicode full stop characters (such as U+FF0E or U+FF61) used in place of the ASCII dot in .php extensions, which are indicators of exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to upgrade FrankenPHP to version 1.12.3 or later, where the vulnerability has been patched by removing the unsafe Unicode fallback in the CGI path splitting function.

Until the upgrade can be applied, restrict or sanitize any user-controlled file uploads or file storage locations served by FrankenPHP to prevent attacker-controlled filenames that could exploit this vulnerability.

Additionally, monitor and block suspicious requests containing Unicode lookalike characters in URLs to reduce the risk of exploitation.

Useful 0 Not Useful 0