FrankenPHP versions prior to 1.13.0 have an authentication bypass vulnerability that enables unauthenticated attackers to spoof trusted HTTP headers. This is achieved by sending dot-form header names that PHP internally rewrites to underscores, allowing attackers to impersonate user identity, client IP, or scheme information.
FrankenPHP versions prior to 1.13.0 have a denial of service vulnerability in the goArray() function. Remote attackers can exploit this by sending specially crafted JSON containing null integer-keyed elements to frankenphp_log() or via worker callback returns. This triggers an unrecovered cgo panic that aborts the server process, terminating all virtual hosts and ongoing requests.
FrankenPHP versions prior to 1.13.2 have an information disclosure vulnerability where libxml errors from earlier client requests are not cleared before processing later requests. This allows attackers sending requests to the same worker thread to access libxml error information from other clients, potentially revealing parsed document fragments and server filesystem paths.
FrankenPHP versions prior to 1.13.2 have an uncontrolled recursion vulnerability in the PHP-to-Go array converter. This flaw occurs because the converter does not detect circular references in PHP arrays. When a self-referential array is passed to frankenphp_log() or returned from a worker callback, it causes a fatal Go stack overflow that terminates the entire server process.
FrankenPHP versions before 1.13.4 have a denial of service vulnerability in worker mode. The function frankenphp_handle_request() may return false without completing the request after a fatal error during startup. This can cause client requests to hang indefinitely while the worker process remains active.
FrankenPHP standalone static binaries from version 1.8.0 up to but not including 1.13.2 include a statically linked PHP brotli extension with Brotli 1.2.0. This version of Brotli contains an out-of-bounds write vulnerability (CVE-2026-111497) in its decoder. Unauthenticated remote attackers can exploit this by sending crafted data to applications that use brotli_uncompress_add(), potentially causing the FrankenPHP process to crash and possibly leading to memory disclosure or code execution.
FrankenPHP versions prior to 1.13.4 have a use-after-free vulnerability in worker mode involving internal streams of SplTempFileObject or SplFileObject on php://temp instances that persist across requests. This flaw allows remote clients to trigger reads of freed memory, potentially leaking garbage data or causing process crashes.
FrankenPHP versions before 1.13.4 have a double free vulnerability in worker mode that occurs when a worker script ends its loop after a non-form POST request. This flaw allows unauthenticated attackers to send repeated JSON POST requests, potentially causing the worker process to abort when the environment variable USE_ZEND_ALLOC is set to 0.
FrankenPHP versions prior to 1.13.4 have an information disclosure vulnerability in worker mode where environment variables from one request can leak into subsequent requests on the same PHP thread. This allows attackers to access sensitive per-request environment data such as routing, tenant, or authorization values via getenv() or $_SERVER, potentially causing unauthorized application behavior.
FrankenPHP versions before 1.13.4 have a use-after-free vulnerability triggered by calling putenv() during request shutdown. This flaw causes a dangling pointer to a freed environment table, which can lead to process crashes on subsequent getenv() calls or leakage of environment values from previous requests.
Rustrak versions before 0.26.0 have a server-side request forgery (SSRF) vulnerability. This flaw allows users with integrations update permission to send crafted requests to arbitrary destinations by using the routing_override.url parameter in the POST /api/integrations/{id}/test endpoint. Exploitation can target internal network addresses including loopback, private network, and cloud metadata services, with the ability to follow redirects and include custom headers. The API response reveals non-2xx response bodies, potentially exposing sensitive information.
Ryot versions prior to 10.5.6 have an authorization bypass vulnerability that allows authenticated users to revoke access links belonging to other users. This occurs because the system does not verify ownership when revoking access links, enabling attackers to disrupt shared access by revoking links using arbitrary accessLinkIds obtained from public share URLs.
Jadaptive Maverick Synergy Server versions before 3.0.33 and 3.1.x before 3.1.7, as well as Maverick Legacy Server before 1.8.1, have an authentication bypass vulnerability in SSH public key authentication. This flaw allows attackers with a key authorized for one account to authenticate and then switch usernames on the same connection to gain access to other accounts without proper authorization.
Ryot versions before 10.5.6 have an authorization bypass vulnerability in the createOrUpdateCollection GraphQL mutation. Authenticated users can supply an updateId to take over other users' collections without proper authorization checks. This allows attackers to read collection items, modify metadata, and remove the original owner and collaborators.
Jadaptive Maverick Synergy Server versions before 3.0.33 and 3.1.x before 3.1.7, along with Maverick Legacy Server before 1.8.1, have an improper path equivalence vulnerability. This flaw in the VirtualFileFactory.canonicalisePath function allows authenticated users to bypass mount-level access controls by using specially crafted paths with duplicate separators or dot segments. This can enable unauthorized read or write access to files that should be restricted by the child mount's policy.
2FAuth versions prior to 9.0.1 have a vulnerability in the password recovery process that allows unauthenticated attackers to manipulate reset links by forging the HTTP Host header. This enables attackers to request recovery emails containing tokens with attacker-controlled hosts, potentially leading to account takeover and exposure of stored TOTP/HOTP secrets.
BuildAdmin versions 1.0.1 through 2.3.9 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious javascript: URLs into the admin operation log via the X-Rewrite-URL header. When an administrator clicks the URL open button in the log entry, the injected script executes in the backend origin, stealing the adminInfo token from localStorage and enabling account takeover.
Pagelayer versions before 2.2.1 contain a missing authorization vulnerability in the Abilities API. This flaw allows contributor-level attackers to perform unauthorized actions such as overwriting, publishing, deleting, or duplicating other users' private posts and pages, as well as modifying site-wide theme templates like headers and footers.
OpsTree BuildPiper versions before 2.7.0 have an authorization bypass vulnerability that allows authenticated users to create environments on Kubernetes clusters not assigned to their projects. By tampering with cluster_id and namespace values in requests, attackers can target other projects' clusters and trigger builds and deployments, bypassing project isolation.
OpsTree BuildPiper versions prior to 2.7.0 have an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by using a foreign project environment identifier. This flaw enables cross-project associations that bypass intended project separation controls.