Description
FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATH_INFO, SCRIPT_NAME, and PHP_SELF values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| php | frankenphp | < 1.13.0 | 1.13.0 |
References
- GitHub Security Advisory (GHSA-xxjp-cjxr-2x6m) vendor-advisory
- VulnCheck Advisory: FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos third-party-advisory