CVE-2026-24895
Frankenphp ≤ 1.11.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-24895 is a high-severity Incorrect Behavior Order: Validate Before Canonicalize (CWE-180) vulnerability in Php Frankenphp. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24895 affects FrankenPHP, a modern application server for PHP, in versions prior to 1.11.2. The vulnerability stems from improper handling of Unicode characters in the CGI path splitting logic during case conversion. Specifically, the logic calculates the split index for locating ".php" on a lowercased copy of the request path but applies that byte index to the original path. Go's strings.ToLower() function can increase the byte length of certain UTF-8 characters, such as Ⱥ when lowercased, causing the index to misalign with the original string's position. This results in incorrect SCRIPT_NAME and SCRIPT_FILENAME values, potentially leading FrankenPHP to execute a file other than the one specified in the URI. The issue is classified under CWE-180 (Incorrect Behavior Order: Early Validation) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction by crafting a request URI containing specific Unicode characters. By triggering the byte length mismatch, attackers can manipulate the path resolution to execute an unintended PHP file, enabling arbitrary code execution, data disclosure, or other impacts depending on the server's file structure and permissions. The high confidentiality, integrity, and availability impacts reflect the potential for full server compromise if exploitable files are present.
The vulnerability is fixed in FrankenPHP version 1.11.2. The official security advisory (GHSA-g966-83w7-6w38), release notes, and fixing commit (04fdc0c1e8fde94e2c1ad86217e962c88d27c53e) on the FrankenPHP GitHub repository detail the patch, which addresses the Unicode handling in path splitting. Security practitioners should upgrade to 1.11.2 or later and review server configurations for exposed PHP endpoints.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6699
Vulnerability Data
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path…
more
but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.8V1.1.1V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and evaluation that can discover validation-order defects after they have been coded.
SI-10 requires validity checks on inputs; when implemented with canonicalization preceding validation it structurally prevents the exact ordering flaw.
SA-8 mandates security engineering principles that include correct canonicalization-before-validation ordering for input handling.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct validation order after canonicalization to prevent bypasses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect validation-order defects before deployment.
Secure SDLC mandates input validation and canonicalization order, directly addressing CWE-180.
Application security requirements include proper input handling to prevent validation-before-canonicalization flaws.
Secure architecture principles reduce the likelihood of ordering errors in input processing.
Secure coding standards explicitly require canonicalize-then-validate to eliminate CWE-180.