CVE-2026-24895·PHP vulnerability
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.
- Severity
- critical
- Software
- PHP
- Fixed in
- 1.11.2
- Published
- 2026-02-12
Affected versions
Until: 1.11.2
Fixed in: 1.11.2
How to fix this CVE
Upgrade FrankenPHP to version 1.11.2 or later to resolve a critical Unicode character handling flaw in CGI path splitting. This vulnerability allows an attacker to manipulate file execution by exploiting byte-length misalignment when UTF-8 characters are lowercased during path processing. Verify your installation includes the patched version and restart PHP services after updating.
sudo dnf update phpDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST|GET /.*[\u0100-\u017f]+\.php HTTP/ or requests containing Unicode characters (Latin Extended-A range) in the URI path before .php extensionWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Block HTTP requests containing Unicode characters in the file path component (URI normalization rule) or implement strict path validation that rejects URIs with characters outside ASCII 0-127 in the script path.How to check if you are affected
- Step 1: Check FrankenPHP version with: php -v | grep -i frankenphp or php -i | grep -i version
- Step 2: Verify SCRIPT_NAME and SCRIPT_FILENAME are correctly set by adding var_dump($_SERVER['SCRIPT_NAME'], $_SERVER['SCRIPT_FILENAME']) in a test .php file and inspecting output
- Step 3: Search application and web server logs for unusual file execution patterns, particularly URIs containing Unicode characters (e.g., Ⱥ, ẛ) followed by .php extensions
- Step 4: Confirm the fix with: php -v and validate the version is 1.11.2 or higher; restart PHP-FPM or Apache with sudo systemctl restart php-fpm or sudo systemctl restart apache2
FAQ
What is CVE-2026-24895?
This is a critical vulnerability in FrankenPHP where Unicode character expansion during lowercase conversion causes byte-index misalignment in CGI path splitting, allowing unintended PHP files to be executed on the server.
Is CVE-2026-24895 being actively exploited?
No, according to CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is not currently being actively exploited in the wild, and no public exploits are available.
What versions of PHP/FrankenPHP are affected by CVE-2026-24895?
All FrankenPHP versions prior to 1.11.2 are vulnerable. The exact lower bound is unknown, but all pre-1.11.2 releases should be considered at risk.
How do I check if my server is vulnerable to CVE-2026-24895?
Run: php -v and look for FrankenPHP version. If it shows a version lower than 1.11.2, your system is vulnerable. For more detail, check: php -i | grep -A5 -B5 FrankenPHP
Does Defensia detect CVE-2026-24895?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP/FrankenPHP is installed on a monitored server, CVE-2026-24895 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-24895. Free for 1 server.
Get started free