GO-2026-4486 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp

🗓️ 17 Feb 2026 18:09:06Reported by GoogleType

osv

osv🔗 osv.dev👁 4 Views

FrankenPHP unicode case-folding expansion breaks split_path index and SCRIPT_NAME PATH_INFO.

Reporter	Title	Published	Views	Family All 117
ATTACKERKB	CVE-2026-24895	12 Feb 202619:16	–	attackerkb
Circl	CVE-2026-24895	12 Feb 202612:40	–	circl
CNNVD	FrankenPHP 安全漏洞	12 Feb 202600:00	–	cnnvd
CVE	CVE-2026-24895	12 Feb 202619:16	–	cve
Cvelist	CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files	12 Feb 202619:16	–	cvelist
Github Security Blog	FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP	12 Feb 202615:29	–	github
Github Security Blog	Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files	18 May 202613:40	–	github
NVD	CVE-2026-24895	12 Feb 202620:16	–	nvd
OSV	CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files	12 Feb 202619:16	–	osv
OSV	GHSA-G966-83W7-6W38 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP	12 Feb 202615:29	–	osv

Source	Link
github	www.github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24895
github	www.github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e
github	www.github.com/php/frankenphp/releases/tag/v1.11.2

19 Feb 2026 20:41Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.19.8

CVSS 49.3

EPSS0.0058

SSVC

FrankenPHP unicode split_path SCRIPT_NAME PATH_INFO confusion