CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

• CWE-180

• https://github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53ePatch
• https://github.com/php/frankenphp/releases/tag/v1.11.2Release Notes
• https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38Exploit, Vendor Advisory

Published

Feb 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5
• CVE-2026-24892openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24893openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24894FrankenPHP is a modern application server for PHP. Prior to …7.5
• CVE-2026-24896OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24897Erugo is a self-hosted file-sharing platform. In versions up…8.8
• CVE-2026-24898OpenEMR is a free and open source electronic health records …9.8
• CVE-2026-24899Fleet is open source device management software. Prior to ve…7.5
• CVE-2026-2490RustDesk Client for Windows Transfer File Link Following Inf…5.5
• CVE-2026-24900MarkUs is a web application for the submission and grading o…6.5