CVE-2026-128025: FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos
FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATHINFO, SCRIPTNAME, and PHPSELF values.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
FrankenPHP deployments using a version before 1.13.0 are affected where CGI path handling is used and protected or uploaded PHP scripts can be reached through attacker-controlled request paths. Route-level and WAF deny rules may be bypassed because the server interprets embedded .php path components differently.
What does an attacker need to exploit it?
The vulnerability is remotely exploitable without authentication or user interaction. An attacker needs to send a crafted request containing .php within a filename component, such as /uploads/a.php.txt/b.php.
How can I tell whether an instance may be vulnerable?
An instance may be vulnerable if it runs FrankenPHP before 1.13.0. Testing should focus on whether requests with embedded .php components cause execution of an earlier PHP file and whether PATH_INFO, SCRIPT_NAME, or PHP_SELF can be forged.
What is the immediate remediation?
Upgrade FrankenPHP to version 1.13.0 or later. The provided information does not identify a confirmed workaround for installations that cannot be upgraded immediately.