php franken up to 1.11.1 Unicode Character ToLower validate before canonicalize

Summaryinfo

A vulnerability classified as critical has been found in php franken up to 1.11.1. This vulnerability affects the function ToLower of the component Unicode Character Handler. This manipulation causes validate before canonicalize. The identification of this vulnerability is CVE-2026-24895. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in php franken up to 1.11.1. Affected by this vulnerability is the function ToLower of the component Unicode Character Handler. The manipulation with an unknown input leads to a validate before canonicalize vulnerability. The CWE definition for the vulnerability is CWE-180. The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-24895 since 01/27/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.11.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 04fdc0c1e8fde94e2c1ad86217e962c88d27c53e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• php

Name

• franken

Version

• 1.11.0
• 1.11.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion