8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45062

CVE-2026-45062: FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45062

CVE-2026-45062:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dunglas/frankenphp	go	>= 1.11.2, <= 1.12.2	1.12.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the splitPos function located in the cgi.go file of the FrankenPHP project. The function is responsible for splitting the request path to determine the script to be executed. The vulnerability is caused by improper handling of Unicode characters in the path. The original implementation used golang.org/x/text/search with search.IgnoreCase, which led to two distinct flaws.

First, a control-flow flaw allowed a stale match variable to cause a false positive when a non-ASCII character was present in the path. This would cause the server to misinterpret the path and execute a file that was not intended to be executed as a PHP script.

Second, the search.IgnoreCase option performed Unicode equivalence matching, which is broader than simple ASCII case-insensitivity. This allowed attackers to use various Unicode characters that are visually similar to the characters in .php to craft a filename that would be incorrectly identified as a PHP script. For example, a file named shell.ｐhp (using a full-width 'p') would be treated as a PHP file.

An attacker who can upload a file to a server running a vulnerable version of FrankenPHP could exploit this vulnerability by crafting a URL with a specially crafted path. This would lead to the execution of the uploaded file as a PHP script, resulting in remote code execution.

The patch addresses these issues by removing the dependency on golang.org/x/text/search and replacing the logic with a strict ASCII byte-level comparison. This ensures that only legitimate .php files are executed as PHP scripts.

Vulnerable functions

splitPos

cgi.go

The `splitPos` function in `cgi.go` was vulnerable to two flaws related to unsafe Unicode handling. The first flaw was a logic error where a `match` variable was not reset correctly when encountering a non-ASCII byte, leading to a false positive match. The second flaw was due to the use of `golang.org/x/text/search` with `search.IgnoreCase`, which performed Unicode equivalence matching. This allowed an attacker to use Unicode characters that are visually similar to ASCII characters (e.g., using a full-width 'p' instead of a regular 'p' in '.php') to bypass the file extension check and have a non-PHP file be executed as a PHP script. The patch fixes this by removing the Unicode-aware search and implementing a strict ASCII byte-level comparison.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.