CVE-2026-24895 is a critical flaw (CVSS 9.8) in FrankenPHP, the PHP application server. Its CGI path splitting handles Unicode case conversion badly, so it can pick the wrong script to run for a request. FrankenPHP 1.11.2 fixes it, and the release notes call for an immediate upgrade.
What's affected
- Affected: FrankenPHP before 1.11.2, per the NVD record.
- Fixed in: 1.11.2, released on 12 February.
The advisory's affected range for the Go module reads below 1.1.2, which does not match the patched version of 1.11.2. Use 1.11.2 as your target and confirm the range in the advisory.
The 1.11.2 release notes describe three security fixes. This CVE is the path confusion issue. The other two are a session leak between requests handled by workers and delayed propagation of security fixes in upstream base Docker images. The release notes call it an important security update and strongly recommend upgrading right away.
How to check if you're exposed
Find out which version you run.
frankenphp version
If you run FrankenPHP in a container, check the image tag, and check when the image was last rebuilt. Base images that were pinned before 12 February may still carry an older build.
docker image ls | grep -i frankenphp
If you use FrankenPHP as a Go library, check your go.mod file for the module github.com/dunglas/frankenphp.
go list -m all | grep frankenphp
Also review how your app treats file uploads. The advisory's concern is that the server might execute a file other than the one the URI names, so any path where users can place files under the document root deserves a look.
What to do now
- Upgrade to FrankenPHP 1.11.2 or later.
- Rebuild and redeploy container images instead of patching in place, and pull a fresh base image when you do.
- Audit directories that accept user uploads, and make sure they cannot be served as executable PHP.
- Look through web server logs for unusual Unicode characters in request paths ahead of a php segment, which can show someone probing for the issue.
- Add FrankenPHP to your software inventory so the next release note reaches you.
Why it matters
The bug is a mismatch between two views of the same string. The code lowercases the request path to find the .php boundary, then uses that byte position on the original path. In Go, lowercasing some characters changes their byte length. The position no longer lines up, and the script name and filename that FrankenPHP computes can be wrong. The advisory says this can cause a file other than the intended one to be executed.
The weakness is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). It is a good example of why validation and normalization must happen in the right order. Anything that checks a value must look at the same bytes the later code will use.
For teams that run FrankenPHP in containers, the second lesson is operational. A patched upstream release does nothing for you until your pipeline rebuilds the image. Watch the base image as well as your own code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-24895 on the CISA KEV list?
No. The record marks it as not known exploited, and the advisory does not say otherwise.
Does the fix need a code change in my application?
The advisory describes a fix inside FrankenPHP's path splitting. Upgrading the server is what it asks for, and it names no application change.
Sources
Last reviewed: 19 October 2026.
