Secuno
ENNL
Book demo

CVE-2026-24895

PHP Frankenphp vulnerability

9.8 CRITICALPublic exploitEPSS 0.61%
  1. Published12 Feb 2026

Description

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

PHP Frankenphp< 1.11.2

Remediation

Fixed in
PHP Frankenphp≥ 1.11.2

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-157049.8
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled…
CVE-2026-527478.6
ModSecurity is an open source, cross platform web application firewall (WAF) engine for…
CVE-2026-487218.6
Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until…
CVE-2026-275909.8
Caddy is an extensible server platform that uses TLS by default. Prior to version…

Frequently asked

Is CVE-2026-24895 being actively exploited?

CVE-2026-24895 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.61%.

How severe is CVE-2026-24895?

CVE-2026-24895 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.61% probability of exploitation.

Which products are affected by CVE-2026-24895?

Affected products include PHP Frankenphp.

How do I fix CVE-2026-24895?

Upgrade affected software to a fixed version, for example PHP Frankenphp 1.11.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-24895 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.