Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/02/12 3:29 p.m.31 views

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

Summary FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower in Go can increase the...

9.8CVSS6.2AI score0.00573EPSS
SaveExploits1References5Affected Software1
Rows per page
Query Builder