CVE-2026-45062: FrankenPHP RCE Vulnerability

CVE-2026-45062 Overview

FrankenPHP is a modern application server for PHP built on top of the Caddy web server. CVE-2026-45062 affects the splitPos() function in cgi.go, which misuses golang.org/x/text/search with search.IgnoreCase when a request path contains a non-ASCII byte. Two distinct flaws in the fallback logic allow an attacker to trick FrankenPHP into treating a non-.php file as a PHP script. In deployments where attackers can place content into files served by FrankenPHP, such as uploads or file storage backends, the flaws escalate to remote code execution. Versions from 1.11.2 up to but not including 1.12.3 are affected.

Critical Impact
Attackers who can write files to a FrankenPHP-served path can achieve remote code execution by crafting URLs that contain non-ASCII bytes, bypassing PHP extension checks.

Affected Products

FrankenPHP versions 1.11.2 through 1.12.2
PHP applications deployed behind FrankenPHP with user-controllable file storage
Containerized and bare-metal FrankenPHP installations exposing upload endpoints

Discovery Timeline

2026-06-10 - CVE-2026-45062 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45062

Vulnerability Analysis

The vulnerability resides in the splitPos() function inside cgi.go, which determines where a request path ends and PATH_INFO begins. The function uses golang.org/x/text/search with the search.IgnoreCase option as a fallback when a path contains non-ASCII bytes. The Unicode-aware search routine does not behave equivalently to a simple byte-wise extension check, producing inconsistent results between the path-splitting logic and the actual file resolution. As a result, FrankenPHP can route requests to the PHP interpreter even when the resolved file does not have a .php extension. The flaw is classified as Improper Input Validation [CWE-20].

Root Cause

The root cause is a mismatch between two path-handling code paths. When the request URL contains a non-ASCII byte, splitPos() switches from byte-level matching to a locale-aware Unicode search that applies case folding and normalization. The Unicode comparison can locate a .php substring that does not exist as a literal extension on disk, or it can fail to anchor the match at the correct position. The PHP interpreter is then handed a file that the server validators never confirmed was a PHP script.

Attack Vector

An attacker first uploads or writes attacker-controlled content into any location served by FrankenPHP, such as an avatar directory, document store, or static asset path. The attacker then issues an HTTP request whose path contains a carefully chosen non-ASCII byte sequence near the uploaded filename. The malformed path triggers the search.IgnoreCase fallback in splitPos(), causing FrankenPHP to dispatch the uploaded file to the PHP runtime. The runtime executes whatever PHP code the attacker placed inside the file, yielding remote code execution under the FrankenPHP process account.

No verified public exploit code is available. Technical details are described in the GitHub Security Advisory GHSA-3g8v-8r37-cgjm.

Detection Methods for CVE-2026-45062

Indicators of Compromise

HTTP access log entries containing non-ASCII bytes or percent-encoded high-byte sequences in the request path, particularly near upload directories.
PHP execution events tied to files with non-.php extensions, including images, archives, or text documents.
Outbound network connections initiated by the FrankenPHP process to unexpected hosts shortly after a file upload event.

Detection Strategies

Inspect FrankenPHP and reverse-proxy access logs for request URIs containing UTF-8 multi-byte sequences combined with .php substrings.
Correlate file upload events with subsequent requests that reference the uploaded filename to identify suspicious access patterns.
Monitor process telemetry for PHP child processes spawned from request paths that do not terminate in .php.

Monitoring Recommendations

Enable verbose request logging on FrankenPHP and forward logs to a centralized analytics platform for retention and search.
Alert on PHP interpreter execution where the resolved script path includes user-writable directories.
Baseline normal PHP execution paths so that anomalous file types invoked by FrankenPHP generate immediate alerts.

How to Mitigate CVE-2026-45062

Immediate Actions Required

Upgrade FrankenPHP to version 1.12.3 or later, which contains the fix for the splitPos() logic.
Audit all directories writable by web users and confirm none are served directly through FrankenPHP without strict extension enforcement.
Review recent access logs for non-ASCII paths and investigate any matches for signs of exploitation.

Patch Information

The issue is patched in FrankenPHP 1.12.3. Release notes and source changes are available in the FrankenPHP v1.12.3 release. Operators running affected versions between 1.11.2 and 1.12.2 should upgrade immediately. Container deployments must rebuild and redeploy images that reference older base tags.

Workarounds

Place a reverse proxy in front of FrankenPHP that rejects request paths containing non-ASCII bytes until the upgrade can be applied.
Store user uploads outside any directory served by FrankenPHP and serve them through a separate static handler that never invokes PHP.
Restrict file upload handlers to strict content-type and extension allowlists, and rewrite uploaded filenames to a safe ASCII-only scheme.

bash

# Verify the installed FrankenPHP version and upgrade
frankenphp version

# Pull the patched container image
docker pull dunglas/frankenphp:1.12.3

# Restart services using the patched image
docker compose pull && docker compose up -d