8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24895

CVE-2026-24895: FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24895

CVE-2026-24895:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dunglas/frankenphp	go	< 1.11.2	1.11.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path confusion issue in FrankenPHP's CGI path splitting logic, caused by improper handling of Unicode characters. The root cause lies in the frankenphp.splitPos function located in cgi.go. This function used strings.ToLower() on the entire request path to find the position of a script extension (e.g., .php). However, for certain Unicode characters, their lowercase representation has a different byte length than the original character. This discrepancy caused splitPos to return a byte index that was correct for the lowercased string but incorrect for the original path string.

The vulnerability is triggered in the frankenphp.splitCgiPath function, which consumes this incorrect index to split the original path into SCRIPT_NAME and PATH_INFO. This could cause the server to treat a larger portion of the path as the script to be executed, leading to a scenario where a non-PHP file (e.g., a user-uploaded text file) could be executed as a PHP script, resulting in Remote Code Execution (RCE).

The patch resolves this by completely rewriting the splitPos function. The new implementation avoids strings.ToLower() on the whole path. Instead, it iterates through the path and performs a manual, case-insensitive comparison for ASCII characters, and uses a dedicated library (golang.org/x/text/search) for safe, case-insensitive matching of non-ASCII characters. This ensures the returned index is always correct for the original path string. Additionally, the frankenphp.WithRequestSplitPath function was hardened to reject non-ASCII characters in the split path specifiers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.