5.3
Moyenne
CVE-2026-85733 FrankenPHP is a modern application server for PHP
Description
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| frankenphp 1.12 | premières → < 1.12.5 | 1.12.5 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de frankenphp
Les 6 CVE de frankenphp →
CVE-2026-122233
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
6.3
Moyenne
CVE-2026-82416
FrankenPHP is a modern application server for PHP
7.7
Élevée
CVE-2026-45062
FrankenPHP is a modern application server for PHP
8.1
Élevée
CVE-2026-24895
FrankenPHP is a modern application server for PHP
8.9
Élevée