Unsecured CGI Path Splitting in FrankenPHP Affects PHP Application Servers

CVE-2026-24895

What is CVE-2026-24895?

FrankenPHP, a PHP application server, exhibits a vulnerability in its CGI path splitting logic. Prior to version 1.11.2, the server improperly handles Unicode characters during case conversion. This flaw arises as the logic for determining the split index is applied to a lowercased request path without ensuring the alignment with the original path. Consequently, specific UTF-8 characters can result in positioning errors that may lead to unintended script execution, potentially executing files other than those specified by the URI. Users are urged to update to version 1.11.2 to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References