CVE-2026-45062: FrankenPHP Remote Code Execution via Non-ASCII Path Handling

Technical summary

The vulnerability stems from misuse of golang.org/x/text/search with the IgnoreCase option in the splitPos() function within cgi.go. When a request path contains non-ASCII bytes, the case-insensitive search logic fails to correctly identify file extensions, creating two distinct attack pathways. Both flaws allow an attacker to cause FrankenPHP to interpret non-.php files as PHP executables. The issue is classified under CWE-176 (Improper Handling of Unicode Encoding), CWE-178 (Improper Handling of Case Sensitivity), and CWE-20 (Improper Input Validation), reflecting the root cause in encoding and validation logic.

Business impact

For organizations running FrankenPHP in production, this vulnerability poses a severe risk. Any attacker who can place files on your server—through uploads, content management systems, file storage integrations, or other mechanisms—can achieve remote code execution. This could lead to data theft, system compromise, malware installation, or lateral movement within your infrastructure. The high CVSS score (8.1) reflects the ease of exploitation in environments where user file uploads are permitted, combined with the critical nature of code execution.

Affected systems

FrankenPHP versions 1.11.2 through 1.12.2 are affected. Version 1.12.3 and later contain the patch. Organizations should audit their deployment documentation or run `frankenphp --version` to determine if they are running a vulnerable release. This vulnerability affects all deployments regardless of operating system or hosting environment.

Exploitability

The vulnerability requires network access and the ability to place a file on the server, but does not require authentication or user interaction. An attacker must craft a malicious request URL that exploits the non-ASCII byte handling logic; the CVSS vector (AC:H) indicates moderate attack complexity, likely due to the need to identify or craft the correct payload. In real-world scenarios where uploads are enabled, exploitability is straightforward once an attacker understands the flaw.

Remediation

Upgrade FrankenPHP to version 1.12.3 or later immediately. This is a straightforward patch that corrects the splitPos() function logic. Before upgrading, consider restricting file uploads, validating uploaded file types strictly, or isolating FrankenPHP instances that accept user uploads. After patching, verify your deployment and monitor logs for any suspicious file requests using non-ASCII characters.

Patch guidance

Update to FrankenPHP version 1.12.3 or any subsequent release. Consult the official FrankenPHP release notes and installation documentation at the project repository for upgrade procedures specific to your deployment method (Docker, standalone binary, or compiled from source). Test the upgrade in a non-production environment first to ensure compatibility with your application stack. If you are on version 1.12.2 or earlier, prioritize this upgrade within your change management process.

Detection guidance

Monitor access logs for HTTP requests with non-ASCII characters in the path, especially those attempting to access or execute files with suspicious extensions. Look for patterns where requests reference files that are not .php but are followed by URL paths or parameters designed to trigger execution. Intrusion detection systems can be configured to alert on requests with encoded non-ASCII bytes (e.g., %xx patterns) targeting known upload directories. If you suspect exploitation, review recent file uploads and check for unexpected PHP execution or suspicious process activity on the server.

Why prioritize this

This vulnerability merits immediate remediation due to its combination of high impact (remote code execution) and practical exploitability in common deployment scenarios. The relatively low attack complexity (in realistic upload scenarios) and the ability to cause severe damage (confidentiality, integrity, and availability compromise) make it a priority for any security team. Organizations that allow file uploads should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects a network-accessible vulnerability requiring moderate attack complexity, with no privilege escalation or special conditions, that results in complete compromise of confidentiality, integrity, and availability. The score appropriately captures the severity of remote code execution; the 'AC:H' modifier acknowledges that successful exploitation requires crafting a specific payload, but does not reduce urgency given the prevalence of file upload features in modern web applications.

Frequently asked questions