CVE-2026-45062: FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

Synopsis

An unsafe Unicode handling flaw in FrankenPHP's CGI path-splitting logic allows a remote attacker to trick the server into executing non-PHP files as PHP scripts. The vulnerability is reachable over the network without any authentication, though exploitation requires overcoming moderate complexity (an attacker must also be able to place content into a file served by FrankenPHP). Successful exploitation gives the attacker full remote code execution on the host, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 1.12.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FrankenPHP service over the network; the vulnerable path-parsing code is exercised on incoming HTTP requests.

• AuthenticationNot required

  No credentials or account are needed; the malicious request can be sent by any unauthenticated client.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted HTTP request directly to the server.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must also control a file served by FrankenPHP (for example via an upload endpoint) and craft a URL path containing a non-ASCII byte sequence that triggers the Unicode fallback flaw.

Blast Radius

• Attacker achieves remote code execution by causing FrankenPHP to interpret an attacker-supplied file as a PHP script, running arbitrary server-side code under the web server's process identity.
• Arbitrary code execution gives read access to application secrets, environment variables, database credentials, and any files readable by the server process.
• The attacker can write or overwrite files on the server, modify application data, or plant a persistent web shell.
• The server process can be crashed or exhausted, taking down the FrankenPHP application and any services it backs.