CVE-2026-128025 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.0 splits request paths in a way that can differ from how routing and WAF rules read them. An unauthenticated attacker can request a path such as /uploads/a.php.txt/b.php to run a PHP script that deny rules were meant to block.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running FrankenPHP older than 1.13.0 that serve PHP scripts, especially where users can upload files into web-accessible directories and route or WAF rules are used to block PHP execution. Deployments that do not run FrankenPHP, or that already run 1.13.0 or later, are not affected.
Not affected if frankenphp-1.13.0-or-later, no-php-uploads
Who cares frankenphp, php, self-hosted, waf
frankenphp version or the version in your build or container image.1.13.0 or later.FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATH_INFO, SCRIPT_NAME, and PHP_SELF values.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.