CVE-2026-128025

The FrankenPHP web server version before 1.13.0 is vulnerable to a path-split interpretation conflict in the splitPos function within cgi.go . This flaw allows unauthenticated attackers to bypass route-level or WAF deny rules by embedding .php extensions inside filename components (e.g., requesti...