Summary
CVE-2026-45062 is a high-severity Unicode path confusion vulnerability in FrankenPHP, a modern PHP application server, affecting versions 1.11.2 through 1.12.2. The flaw resides in the splitPos() function in cgi.go, where improper use of a Unicode-aware string-search library allows an attacker to craft a URL path that causes FrankenPHP to treat a non-.php file as a .php script. In any deployment where an attacker can place content into a FrankenPHP-served directory — for example, through a file upload feature — this vulnerability escalates to full Remote Code Execution (RCE). A patch is available as of June 10, 2026 in version 1.12.3.
Technical details
- Root cause: The
splitPos()function incgi.gousesgolang.org/x/text/searchwith thesearch.IgnoreCaseflag to locate.phpin a request path. This fallback is invoked when the path contains a non-ASCII byte. Two distinct flaws exist in this code path:- Flaw 1 — Stale match variable: When a non-ASCII byte is encountered during the inner matching loop, the function breaks out of the loop without resetting the
matchflag tofalse. This leavesmatchincorrectly set totrue, causingsplitPos()to return a position as if.phphad been found when it had not. - Flaw 2 — Unicode equivalence folding: The
search.IgnoreCaseimplementation applies Unicode compatibility decomposition and case folding, causing visually distinct but Unicode-equivalent characters (e.g.,﹒php,．php,.ｐhp,.𝗽𝗵𝗽,.ⓟⓗⓟ) to match against the ASCII.phpextension, bypassing the file-type check entirely.
- Flaw 1 — Stale match variable: When a non-ASCII byte is encountered during the inner matching loop, the function breaks out of the loop without resetting the
- Trigger conditions: The attack requires the attacker to be able to place a file with an attacker-controlled name or content into a directory served by FrankenPHP — for example, via a file upload endpoint, user-content store, or shared hosting directory. The attacker then sends a crafted HTTP request whose path triggers either flaw, causing FrankenPHP to execute the non-PHP file as a PHP script.
- Attack vector: Network (AV:N), unauthenticated (PR:N), no user interaction required (UI:N).
- Impact: Full Remote Code Execution (RCE) within the FrankenPHP process — confidentiality, integrity, and availability are all fully compromised (C:H/I:H/A:H).
- Fix approach: The patch in version 1.12.3 removes the
golang.org/x/text/searchfallback entirely. Any byte value ≥utf8.RuneSelfin the request path is now treated as a non-match, eliminating both bypass vectors while preserving correct behavior for all legitimate ASCII paths.
Affected software
- FrankenPHP (Go module
github.com/dunglas/frankenphp) — versions 1.11.2 through 1.12.2 (inclusive)
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate — Upgrade: Upgrade FrankenPHP to version 1.12.3 or later. This is the only complete fix and is the vendor-recommended remediation.
- Defense-in-depth (if immediate patching is not feasible):
- Store all user-uploaded or user-controlled files outside the FrankenPHP document root to prevent an attacker from placing files that can be executed.
- Deploy a Web Application Firewall (WAF) rule that rejects HTTP requests containing multi-byte Unicode characters (bytes ≥ 0x80) in the URL path, reducing exploitability until patching is completed.
- Restrict file upload functionality or enforce strict server-side allowlists on acceptable file extensions and upload destinations.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.