CVE-2026-45062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45062", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T18:45:10.095Z", "datePublished": "2026-06-10T17:38:42.454Z", "dateUpdated": "2026-06-11T14:00:50.845Z"}, "containers": {"cna": {"title": "FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-176", "lang": "en", "description": "CWE-176: Improper Handling of Unicode Encoding", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-178", "lang": "en", "description": "CWE-178: Improper Handling of Case Sensitivity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm"}, {"name": "https://github.com/php/frankenphp/releases/tag/v1.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/php/frankenphp/releases/tag/v1.12.3"}], "affected": [{"vendor": "php", "product": "frankenphp", "versions": [{"version": ">= 1.11.2, < 1.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T17:38:42.454Z"}, "descriptions": [{"lang": "en", "value": "FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3."}], "source": {"advisory": "GHSA-3g8v-8r37-cgjm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T14:00:18.823214Z", "id": "CVE-2026-45062", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T14:00:50.845Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45062", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T18:45:10.095Z", "datePublished": "2026-06-10T17:38:42.454Z", "dateUpdated": "2026-06-11T14:00:50.845Z"}, "containers": {"cna": {"title": "FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-176", "lang": "en", "description": "CWE-176: Improper Handling of Unicode Encoding", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-178", "lang": "en", "description": "CWE-178: Improper Handling of Case Sensitivity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm"}, {"name": "https://github.com/php/frankenphp/releases/tag/v1.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/php/frankenphp/releases/tag/v1.12.3"}], "affected": [{"vendor": "php", "product": "frankenphp", "versions": [{"version": ">= 1.11.2, < 1.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T17:38:42.454Z"}, "descriptions": [{"lang": "en", "value": "FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3."}], "source": {"advisory": "GHSA-3g8v-8r37-cgjm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45062", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T14:00:18.823214Z"}}}], "references": [{"url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T14:00:42.788Z"}}]}}

{"affected": [{"affectedData": [{"product": "frankenphp", "vendor": "php", "versions": [{"status": "affected", "version": ">= 1.11.2, < 1.12.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3."}, {"lang": "es", "value": "FrankenPHP es un moderno servidor de aplicaciones para PHP. Desde la versi\u00f3n 1.11.2 hasta antes de la versi\u00f3n 1.12.3, la funci\u00f3n splitPos() en cgi.go hace un uso indebido de golang.org/x/text/search con search.IgnoreCase cuando la ruta de la solicitud contiene un byte no ASCII. Dos fallos distintos en esa alternativa permiten a un atacante enga\u00f1ar a FrankenPHP para que trate un archivo que no es .php como un script .php. En cualquier despliegue donde el atacante pueda colocar contenido en un archivo servido por FrankenPHP (cargas, almacenamiento de archivos, etc.), esto puede escalarse a ejecuci\u00f3n remota de c\u00f3digo al crear una URL cuya ruta active cualquiera de los fallos. Este problema ha sido parcheado en la versi\u00f3n 1.12.3."}], "id": "CVE-2026-45062", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45062", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T14:00:18.823214Z", "version": "2.0.3"}}]}, "published": "2026-06-10T18:16:57.077", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/php/frankenphp/releases/tag/v1.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-176"}, {"lang": "en", "value": "CWE-178"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.11.2,1.12.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "frankenphp", "source": "cna", "vendor": "php"}, "product": "frankenphp", "vendor": "php"}], "created": "2026-06-10T19:30:36.813736+00:00", "updated": "2026-06-10T19:45:39.061801+00:00", "vendors": ["php", "php$PRODUCT$frankenphp"]}