CVE-2026-128021: FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(errorlist) between requests. Attackers sending requests to the same worker thread can call libxmlgeterrors() or libxmlgetlasterror() to obtain other clients' parsed-document fragments and server filesystem paths.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FrankenPHP deployments running a version before 1.13.2 and using worker mode are exposed. The issue depends on libxml error state persisting between requests handled by the same worker thread.
What does an attacker need to exploit it?
An attacker needs to send requests that are handled by the same worker thread as an earlier client request. They can then invoke libxml_get_errors() or libxml_get_last_error() to retrieve retained libxml error information.
What information could be disclosed?
The retained errors may expose fragments of documents parsed for earlier clients and filesystem paths on the server.
How can this be remediated?
Upgrade FrankenPHP to version 1.13.2 or later. The affected versions are those before 1.13.2.