CVE-2026-45062

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3.

• CWE-20
• CWE-176
• CWE-178

• https://github.com/php/frankenphp/releases/tag/v1.12.3
• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm
• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9
• CVE-2026-45055CubeCart is an ecommerce software solution. Prior to 6.7.2, …8.1
• CVE-2026-45058electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.4
• CVE-2026-4506A vulnerability was found in Mindinventory MindSQL up to 0.2…6.3
• CVE-2026-45060ClipBucket v5 is an open source video sharing platform. Prio…9.8
• CVE-2026-45061Budibase is an open-source low-code platform. Prior to 3.35.…7.7
• CVE-2026-45063Symfony is a PHP framework for web and console applications …9.1
• CVE-2026-45064Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-45065Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-45066Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-45067### Description `Symfony\Component\Mime\Address` is the val…6.3
• CVE-2026-45068Symfony is a PHP framework for web and console applications …7.5