CVE-2026-85733: FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FrankenPHP official Debian and Alpine Docker imagesto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Rebuild already derived images or supply an application /app/public/index.php so the phpinfo() placeholder is no longer served.
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use an official FrankenPHP Debian or Alpine Docker image before 1.12.5 and do not replace the bundled /app/public/index.php. Images built using the documented pattern with their own application index are not affected.
What does an attacker need to exploit this issue?
An attacker needs network access to a deployment that serves the bundled placeholder as its production index page. No authentication or user interaction is required.
What information may be exposed?
The phpinfo() page can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths.
What should be done if an affected derived image is already deployed?
Rebuild the derived image with FrankenPHP 1.12.5 or later, or supply an application /app/public/index.php to replace the exposed placeholder.