5.3
Medium
CVE-2026-85733 FrankenPHP is a modern application server for PHP
Description
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| frankenphp 1.12 | earliest → < 1.12.5 | 1.12.5 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of frankenphp
The 6 CVEs of frankenphp →
CVE-2026-122233
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
6.3
Medium
CVE-2026-82416
FrankenPHP is a modern application server for PHP
7.7
High
CVE-2026-45062
FrankenPHP is a modern application server for PHP
8.1
High
CVE-2026-24895
FrankenPHP is a modern application server for PHP
8.9
High