{"id":"CVE-2026-128027","kind":"vulnerability","aliases":["CVE-2026-128027"],"related":[],"title":"FrankenPHP Docker images stale base layers let remote attackers run code","description":"FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.","summary":"FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags appeared, so security fixes shipped by Alpine, PHP and Go under existing tags never reached them. Remote attackers can exploit known flaws in the outdated system libraries inside these images, such as CVE-2025-15467 in libcrypto3, to execute code.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"frankenphp","fixed":["1.1.11"],"affected":"< 1.1.11","ecosystem":"docker"}],"ecosystems":[],"tags":["docker","frankenphp","php","runtime","self-hosted"],"not_affected_if":["own-image-build","version-1.1.11-or-later"],"how_to_check":"- Run docker image inspect <image> and check the Created date. An image pulled or built before Feb 4 2026 may carry stale Alpine libraries.\n- Run docker run --rm <image> apk info -v libcrypto3 and compare with the patched Alpine releases (3.20.9, 3.21.6, 3.22.3, 3.23.3 per the advisory).\n- Check which FrankenPHP version/tag your Dockerfile or compose file uses; the advisory lists <1.1.11 as affected.\n- If you build FROM dunglas/frankenphp, rebuild with --pull.","fix":"Pull the current image for your FrankenPHP tag (docker pull dunglas/frankenphp:<tag>) and rebuild derived images with docker build --pull. Since Feb 4 2026 the project rebuilds images daily when the Alpine, PHP or Go base digest changes. Advisory lists affected as <1.1.11.","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:48:13+00:00","updated_at":"2026-11-13T10:48:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:48:13Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP Docker images: upgrade to `1.1.11` or later, which the sources state is the fixed version.","reach":"internet","title":"FrankenPHP Docker images stale base layers let remote attackers run code","impact":"high","summary":"FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags appeared, so security fixes shipped by Alpine, PHP and Go under existing tags never reached them. Remote attackers can exploit known flaws in the outdated system libraries inside these images, such as CVE-2025-15467 in libcrypto3, to execute code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","docker","php","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker executes code inside the container via stale libraries","analyst_note":"Confirm the exact affected image tags and the vulnerable library list from the vendor advisory at github.com and the VulnCheck advisory before relying on the version check.","how_to_check":"- Run `docker image inspect --format '{{.Config.Labels}}' <image>` on your FrankenPHP image and compare the image build date with the release date of `1.1.11`.\n- Check the FrankenPHP version used in your Dockerfile or compose file; anything below `1.1.11` is affected.\n- Run `docker run --rm <image> apk info -v libcrypto3` to see whether the Alpine library is older than the fixed build.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.1.11-or-later","own-image-build"],"who_is_affected":"Teams that run FrankenPHP in Docker images built from the published base tags before 1.1.11 are exposed, because the images were not rebuilt when Alpine, PHP or Go shipped fixes under existing tags. Teams that build their own images from current base images or that run FrankenPHP outside Docker are not covered by this flaw. The sources do not say which system libraries remain vulnerable beyond the example CVE-2025-15467.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000843,"input_tokens":4610,"output_tokens":763,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact affected image tags and the vulnerable library list from the vendor advisory at github.com and the VulnCheck advisory before relying on the version check.","search":"'-128027':14A,17A '-15467':73B,124C '-2025':72B,123C '-2026':13A,16A '1.1.11':30B,83C 'alpin':45B,98C 'appear':39B 'appli':102C 'attack':9A,56B,110C 'base':5A,36B,89C 'code':11A,78B,129C 'could':111C 'creat':93C 'cve':12A,15A,71B,122C 'docker':2A,19B,27B,80C 'execut':77B,128C 'exist':50B,104C 'exploit':58B,112C 'fix':42B,96C 'flaw':60B,114C 'frankenphp':1A,18A,20B,26B,79C 'go':48B,101C 'host':25B 'imag':3A,28B,37B,68B,81C,90C 'insid':66B 'known':59B,113C 'layer':6A 'let':7A 'libcrypto3':75B,126C 'librari':65B,119C 'never':52B 'new':35B,88C 'outdat':63B 'php':21B,46B,99C 'propag':108C 'reach':53B 'rebuilt':32B,85C 'remot':8A,55B,109C 'run':10A 'runtim':22B 'secur':41B,95C 'self':24B 'self-host':23B 'ship':43B 'stale':4A,117C 'system':64B,118C 'tag':38B,51B,91C,105C","nicknames":[],"mitigations":[],"who_affected":"Teams running the official dunglas/frankenphp Docker images, or images built FROM them, that were pulled or built before the Feb 4 2026 pipeline fix. The images kept old Alpine, PHP and Go layers after upstream patched them under the same tag, so system libraries such as libcrypto3 (CVE-2025-15467) stayed vulnerable. Skip it if you already pulled a current image or build your own from fresh base images.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf","run_id":3848},"products":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf","run_id":3848}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["frankenphp"],"ptokens":["frankenphp"],"labels":["critical","docker","frankenphp","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128027':14A,17A '-2026':13A,16A 'attack':9A 'base':5A 'code':11A 'cve':12A,15A 'docker':2A 'frankenphp':1A,18A 'imag':3A 'layer':6A 'let':7A 'remot':8A 'run':10A 'stale':4A","search_b":"'-15467':73B '-2025':72B '1.1.11':30B 'alpin':45B 'appear':39B 'attack':56B 'base':36B 'code':78B 'cve':71B 'docker':19B,27B 'execut':77B 'exist':50B 'exploit':58B 'fix':42B 'flaw':60B 'frankenphp':20B,26B 'go':48B 'host':25B 'imag':28B,37B,68B 'insid':66B 'known':59B 'libcrypto3':75B 'librari':65B 'never':52B 'new':35B 'outdat':63B 'php':21B,46B 'reach':53B 'rebuilt':32B 'remot':55B 'runtim':22B 'secur':41B 'self':24B 'self-host':23B 'ship':43B 'system':64B 'tag':38B,51B","search_c":"'-15467':124C '-2025':123C '1.1.11':83C 'alpin':98C 'appli':102C 'attack':110C 'base':89C 'code':129C 'could':111C 'creat':93C 'cve':122C 'docker':80C 'execut':128C 'exist':104C 'exploit':112C 'fix':96C 'flaw':114C 'frankenphp':79C 'go':101C 'imag':81C,90C 'known':113C 'libcrypto3':126C 'librari':119C 'new':88C 'php':99C 'propag':108C 'rebuilt':85C 'remot':109C 'secur':95C 'stale':117C 'system':118C 'tag':91C,105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-02-05T09:08:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128027","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128027:3848","url":null,"severity":null,"published_at":"2026-11-13T10:48:54+00:00","modified_at":"2026-11-13T10:48:54+00:00","first_seen_at":"2026-11-13T10:48:54+00:00","fetched_at":"2026-11-13T10:48:54+00:00","note":"Read GHSA-x9p2-77v6-6vhf and VulnCheck. Cause is a CI staleness gap, fixed Feb 4 2026 by daily digest checks; advisory gives no patch version beyond affected <1.1.11. Triage's label-compare check replaced. No exploitation or PoC checked; social not searched."}],"documents":[{"id":145354,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-02-05T09:08:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145355,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.1.11-delayed-propagation-of-base-image-security-fixes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}