{"id":"EUVD-2026-36075","enisaUuid":"3207ce54-2d22-3c81-8b57-3ac7f29f75bb","description":"FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3.","datePublished":"Jun 10, 2026, 5:38:42 PM","dateUpdated":"Jun 11, 2026, 2:00:50 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm\nhttps://github.com/php/frankenphp/releases/tag/v1.12.3\n","aliases":"CVE-2026-45062\nGHSA-3g8v-8r37-cgjm\n","assigner":"GitHub_M","epss":0.71,"enisaIdProduct":[{"id":"8d22b5b6-f2fd-3714-a4eb-944c9d3b6d67","product":{"name":"frankenphp","vendor":{"name":"PHP"}},"product_version":"1.11.2, \u003c 1.12.3"}],"enisaIdVendor":[{"id":"7f6d4944-c7f5-3107-8011-268ce7172e43","vendor":{"name":"PHP"}}],"enisaIdVulnerability":[{"id":"0701e459-7b8d-3a18-91e8-98937c0d15e6","vulnerability":{"id":"CVE-2026-45062","description":"FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3.","datePublished":"Jun 10, 2026, 5:38:42 PM","dateUpdated":"Jun 11, 2026, 2:00:50 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm\nhttps://github.com/php/frankenphp/releases/tag/v1.12.3\n","enisa_id":"EUVD-2026-36075\n","assigner":"GitHub_M","epss":0.71,"dataProcessed":"Nov 5, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"1380367a-653f-3af0-a2e9-453d3f49f41e","product":{"name":"frankenphp","vendor":{"name":"PHP"}},"product_version":"1.11.2, \u003c 1.12.3"}],"vulnerabilityVendor":[{"id":"2bc30d47-842b-3622-a9e9-a389bf70809f","vendor":{"name":"PHP"}}]}},{"id":"b989cc33-dbd9-315b-bceb-291dad3741b2","vulnerability":{"id":"GHSA-3g8v-8r37-cgjm","description":"FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files","datePublished":"May 15, 2026, 5:09:46 PM","dateUpdated":"Jun 10, 2026, 6:41:15 PM","baseScore":0.0,"references":"https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45062\nhttps://github.com/php/frankenphp/commit/2d0f480329a02571d6f635dad9fdb066e1a11e81\nhttps://github.com/php/frankenphp\nhttps://github.com/php/frankenphp/releases/tag/v1.12.3\n","enisa_id":"EUVD-2026-36075\n","aliases":"GHSA-3g8v-8r37-cgjm\nCVE-2026-45062\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}