CVE-2026-128026 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP's putenv writes to the process-wide OS environment, so values set by one request can be seen by others running at the same time. An attacker who reaches a request path that spawns child processes through proc_open or exec can read secrets such as database passwords set by other requests.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running FrankenPHP from 1.5.0 before 1.13.0 are exposed, most where request code sets environment variables with putenv and then runs child processes via proc_open or exec. Applications that do not spawn child processes from request handling are less exposed. unknown whether the sources give further detail on the exact configuration.
Not affected if fixed-version, no-child-processes
Who cares frankenphp, php, self-hosted
frankenphp version or the binary used in the image; affected versions are from 1.5.0 before 1.13.0.putenv, proc_open and exec on request paths.1.13.0 or later (the sources state this as the fixed version).FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.