CVE-2026-24895
Published: 12 February 2026
Summary
CVE-2026-24895 is a critical-severity Incorrect Behavior Order: Validate Before Canonicalize (CWE-180) vulnerability in Php Frankenphp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Unicode path splitting flaw by applying the vendor patch released in FrankenPHP 1.11.2.
Validates incoming request URIs for well-formed Unicode characters and path integrity to block malformed inputs that trigger byte misalignment during case conversion.
Enforces boundary protection via web application firewalls to filter and block crafted URIs exploiting the CGI path resolution vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated RCE vulnerability in the public-facing FrankenPHP web server caused by Unicode mishandling in CGI path logic, allowing attackers to force execution of unintended PHP files; this directly maps to exploitation of a public-facing application.
NVD Description
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path…
more
but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.
Deeper analysisAI
CVE-2026-24895 affects FrankenPHP, a modern application server for PHP, in versions prior to 1.11.2. The vulnerability stems from improper handling of Unicode characters in the CGI path splitting logic during case conversion. Specifically, the logic calculates the split index for locating ".php" on a lowercased copy of the request path but applies that byte index to the original path. Go's strings.ToLower() function can increase the byte length of certain UTF-8 characters, such as Ⱥ when lowercased, causing the index to misalign with the original string's position. This results in incorrect SCRIPT_NAME and SCRIPT_FILENAME values, potentially leading FrankenPHP to execute a file other than the one specified in the URI. The issue is classified under CWE-180 (Incorrect Behavior Order: Early Validation) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction by crafting a request URI containing specific Unicode characters. By triggering the byte length mismatch, attackers can manipulate the path resolution to execute an unintended PHP file, enabling arbitrary code execution, data disclosure, or other impacts depending on the server's file structure and permissions. The high confidentiality, integrity, and availability impacts reflect the potential for full server compromise if exploitable files are present.
The vulnerability is fixed in FrankenPHP version 1.11.2. The official security advisory (GHSA-g966-83w7-6w38), release notes, and fixing commit (04fdc0c1e8fde94e2c1ad86217e962c88d27c53e) on the FrankenPHP GitHub repository detail the patch, which addresses the Unicode handling in path splitting. Security practitioners should upgrade to 1.11.2 or later and review server configurations for exposed PHP endpoints.
Details
- CWE(s)