By weakness (CWE)

CWE-176: related vulnerabilities

CVEs classified under CWE-176. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-45062HIGH 8.1

  FrankenPHP, a PHP application server, contains a critical flaw in how it processes file extensions when request paths include non-ASCII characters. Versions 1.11.2 through 1.12.2 are vulnerable to an attack where an attacker can trick FrankenPHP into executing a non-PHP file as if it were PHP code. If your deployment allows file uploads or stores user-controlled content, an attacker could upload a malicious file and then craft a specially-formed URL to trigger code execution on your server. The vulnerability has been fixed in version 1.12.3.

• CVE-2026-45135HIGH 8.1

  Caddy, a popular TLS-enabled web server platform, contains a flaw in its FastCGI request routing logic that could allow an attacker to execute arbitrary code on affected servers. The vulnerability exists when Caddy processes HTTP requests with non-ASCII characters in the path. An attacker who can upload files or control content served through FastCGI can exploit this misconfiguration to trick Caddy into treating non-script files (like images or documents) as executable scripts, leading to remote code execution. The issue affects versions 2.7.0 through 2.11.2 and is resolved in version 2.11.3.

• CVE-2026-49401HIGH 7.3

  Deno's permission system on macOS can be bypassed using Unicode character variations that represent the same filename. When you tell Deno to block access to a file using `--deny-read`, `--deny-write`, `--deny-run`, or `--deny-ffi`, the runtime compares the requested path against your deny rule at the byte level. However, APFS (Apple's filesystem) treats different Unicode representations of the same character as identical files. An attacker can exploit this mismatch by requesting a file using an alternate Unicode spelling, circumventing the intended permission restriction. This is fixed in Deno 2.7.14.

• CVE-2026-48618MEDIUM 6.5

  Node.js versions 22, 24, and 26 contain a TLS hostname validation flaw that exploits a mismatch in how Unicode dot separators are handled during certificate verification. An attacker with valid credentials can craft a certificate with a specially-formatted hostname that passes wildcard validation checks on the resolver side but fails on the verifier side, potentially allowing them to intercept encrypted traffic or bypass intended security boundaries. The vulnerability requires authenticated access to exploit, but the impact on confidentiality is significant.

• CVE-2026-59890MEDIUM 6.1

  setuptools, a core Python package management tool, contains a vulnerability in how it handles file exclusion rules when building source distributions. On macOS systems using APFS or HFS+ filesystems, attackers or malicious developers can bypass intended file exclusion directives by exploiting Unicode normalization differences. Specifically, files named with decomposed Unicode characters (NFD form) can be packed into distributed Python packages even when exclusion rules target the composed form (NFC). This allows sensitive or malicious files to be included in source distributions when they should have been excluded, potentially affecting downstream package users.