Information Disclosure in FrankenPHP Docker Images by PHP

CVE-2026-85733

What is CVE-2026-85733?

FrankenPHP, a modern application server for PHP, possesses a vulnerability in its Docker images prior to version 1.12.5. The default /app/public/index.php file in these images executes phpinfo(), potentially disclosing sensitive information such as environment variables, PHP configuration details, loaded extensions, software version, and system paths. This can happen when derived images fail to overwrite the default placeholder. To mitigate this risk, affected images need to be rebuilt with a proper application index file.

References