CVE-2026-45062

{
  "id": "CVE-2026-45062",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-10T18:16:57.077",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can place content into a file served by FrankenPHP (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This issue has been patched in version 1.12.3."
    },
    {
      "lang": "es",
      "value": "FrankenPHP es un moderno servidor de aplicaciones para PHP. Desde la versión 1.11.2 hasta antes de la versión 1.12.3, la función splitPos() en cgi.go hace un uso indebido de golang.org/x/text/search con search.IgnoreCase cuando la ruta de la solicitud contiene un byte no ASCII. Dos fallos distintos en esa alternativa permiten a un atacante engañar a FrankenPHP para que trate un archivo que no es .php como un script .php. En cualquier despliegue donde el atacante pueda colocar contenido en un archivo servido por FrankenPHP (cargas, almacenamiento de archivos, etc.), esto puede escalarse a ejecución remota de código al crear una URL cuya ruta active cualquiera de los fallos. Este problema ha sido parcheado en la versión 1.12.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "php",
          "product": "frankenphp",
          "versions": [
            {
              "version": ">= 1.11.2, < 1.12.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-11T14:00:18.823214Z",
          "id": "CVE-2026-45062",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-176"
        },
        {
          "lang": "en",
          "value": "CWE-178"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/php/frankenphp/releases/tag/v1.12.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}