Threats tagged 'ghsa-xwc7-ppx8-9c7r'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.9	CVE-2026-128025FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows Medium6.92026-11-13GCVE DatabaseCVE-2026-128025 FrankenPHP versions before 1.13.0 have a vulnerability in the splitPos function in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php within a filename component. This bypasses route-level or WAF deny rules and enables attackers to manipulate PHP environment variables such as PATH_INFO, SCRIPT_NAME, and PHP_SELF. Report on CVE-2026-128025 Vulnerability CWE-436 #ghsa-xwc7-ppx8-9c7r	GCVE Database	2026-11-13

Page 1 of 1