FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-45062 · Microsoft / collected KEV context

EUVD-2026-36075

GHSA-3g8v-8r37-cgjm

GO-2026-5084

cve-program · CVE-2026-45062

• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm
• https://github.com/php/frankenphp/releases/tag/v1.12.3

euvd · EUVD-2026-36075

• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm
• https://github.com/php/frankenphp/releases/tag/v1.12.3

nvd · CVE-2026-45062

• https://github.com/php/frankenphp/releases/tag/v1.12.3
• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm

osv · GHSA-3g8v-8r37-cgjm

• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm
• https://nvd.nist.gov/vuln/detail/CVE-2026-45062
• https://github.com/php/frankenphp/commit/2d0f480329a02571d6f635dad9fdb066e1a11e81
• https://github.com/php/frankenphp
• https://github.com/php/frankenphp/releases/tag/v1.12.3

osv · GO-2026-5084

• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm
• https://nvd.nist.gov/vuln/detail/CVE-2026-45062
• https://github.com/php/frankenphp/commit/2d0f480329a02571d6f635dad9fdb066e1a11e81
• https://github.com/php/frankenphp/releases/tag/v1.12.3

No related operational record is retained in the current change model.