CVE-2026-85733: FrankenPHP Information Disclosure Vulnerability

CVE-2026-85733 Overview

CVE-2026-85733 is an information disclosure vulnerability in FrankenPHP, a modern application server for PHP. Versions prior to 1.12.5 of the official Debian and Alpine Docker images ship a default /app/public/index.php that executes phpinfo(). Derived images that do not overwrite this placeholder serve the diagnostics page in production environments. The exposed page can reveal environment variables containing secrets, PHP configuration directives, loaded extensions, software versions, and system paths. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve phpinfo() output disclosing environment-based secrets, server paths, and runtime configuration from derived FrankenPHP containers.

Affected Products

FrankenPHP official Debian Docker image prior to 1.12.5
FrankenPHP official Alpine Docker image prior to 1.12.5
Any derived container image that inherits the default /app/public/index.php placeholder

Discovery Timeline

2026-10-13 - CVE-2026-85733 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85733

Vulnerability Analysis

The FrankenPHP Docker images include a placeholder entry file intended as a quick-start demonstration. The Dockerfile writes <?php phpinfo(); into /app/public/index.php during image build. When developers derive an image from this base and forget to overwrite the file, the resulting container serves phpinfo() output on the application root. An unauthenticated HTTP request to the exposed endpoint returns full PHP runtime details.

The disclosed information includes environment variables (often holding database credentials, API keys, and cloud tokens), php.ini directives, loaded extensions, operating system identifiers, and absolute filesystem paths. This information significantly reduces the effort required for follow-on attacks against the application or hosting infrastructure.

Root Cause

The root cause is an insecure default configuration shipped in the base image build layer. The Dockerfile explicitly creates a diagnostics endpoint rather than a benign static page or an empty document root. Image consumers inherit this behavior unless they explicitly replace the file in their own COPY instruction.

Attack Vector

Exploitation requires only an HTTP GET request to the application root of an exposed container. No authentication, user interaction, or special network position is required beyond reachability of the service. Attackers typically identify candidate hosts through internet-wide scanning for phpinfo() fingerprints.

text

# Dockerfile patch - fix(docker): ship a static welcome page instead of phpinfo() (#2524)
 		/data/caddy \
 		/etc/caddy \
 		/etc/frankenphp; \
-	sed -i 's/php/frankenphp run/g' /usr/local/bin/docker-php-entrypoint; \
-	echo '<?php phpinfo();' > /app/public/index.php
+	sed -i 's/php/frankenphp run/g' /usr/local/bin/docker-php-entrypoint

 COPY --link caddy/frankenphp/Caddyfile /etc/caddy/Caddyfile
+COPY --link package/content/index.php /app/public/index.php

Source: GitHub Commit 17940ff. The patch removes the phpinfo() placeholder and replaces it with a static welcome page copied from package/content/index.php.

Detection Methods for CVE-2026-85733

Indicators of Compromise

HTTP responses from application roots containing the string phpinfo() output markers such as PHP Version tables or _SERVER arrays
Unexpected access logs recording GET requests to / or /index.php from unknown source IP addresses targeting container workloads
Outbound connections from application pods immediately following a successful probe to the root endpoint

Detection Strategies

Scan container registries and running images for a /app/public/index.php that contains phpinfo() to identify affected derivatives before deployment.
Query reverse proxy and web server logs for responses with content length and MIME patterns consistent with phpinfo() output served from FrankenPHP workloads.
Perform authenticated web crawls of internal container services and flag any response containing phpinfo headings in HTML.

Monitoring Recommendations

Alert on new deployments of images with the dunglas/frankenphp or php/frankenphp base tagged below 1.12.5.
Monitor for secret rotation triggers whenever environment variables appear in HTTP response bodies.
Track external scanning activity targeting index.php and the application root across container ingress controllers.

How to Mitigate CVE-2026-85733

Immediate Actions Required

Rebuild any derived FrankenPHP image using base version 1.12.5 or later, or supply an application index.php that replaces the placeholder.
Audit running containers for a response body containing phpinfo() output and take them offline until remediated.
Rotate all secrets, API keys, and credentials that may have been exposed via environment variables disclosed by phpinfo().

Patch Information

The issue is fixed in FrankenPHP 1.12.5. The upstream fix removes the phpinfo() placeholder from both the Debian and Alpine Dockerfiles and replaces it with a static welcome page. See the GitHub Security Advisory GHSA-cj57-c655-p798, Pull Request #2524, and the Caddy v1.12.5 release notes for details.

Workarounds

Overwrite /app/public/index.php with the application's own entry file in the derived Dockerfile using an explicit COPY instruction.
Remove the placeholder file in a build stage with RUN rm -f /app/public/index.php if no application index is yet available.
Block public access to the application root via an upstream reverse proxy or web application firewall until a patched image is deployed.

bash

# Dockerfile remediation example for derived images
FROM dunglas/frankenphp:1.12.5

# Replace the placeholder with your application entry point
COPY --chown=www-data:www-data ./public/ /app/public/

# Alternatively, remove the placeholder if no index is available yet
RUN rm -f /app/public/index.php