Incomplete Environment Sandbox Vulnerability in FrankenPHP by PHP

CVE-2026-128026

What is CVE-2026-128026?

FrankenPHP prior to version 1.13.0 is vulnerable to an incomplete environment sandbox vulnerability. The issue arises when the putenv function, utilized for writing to the process-wide environment via os.Setenv, inadvertently exposes sensitive information across concurrent requests. This flaw occurs when attackers access a request path that generates child processes, using methods like proc_open or exec, enabling them to read sensitive data such as database passwords set by previous requests. Organizations utilizing affected versions should take immediate action to update their installations to mitigate the risk of unauthorized access to sensitive environment variables.

References