FrankenPHP’s splitPos() routine that tokenizes CGI request paths misuses a case‑insensitive search when a non‑ASCII byte is present. This causes the engine to misclassify a file that is not a .php script as a PHP script. An attacker who can write a file to a directory served by FrankenPHP can therefore craft a URL whose path triggers either of the two fallback flaws, resulting in the server executing the file as PHP code. The consequence is full remote code execution, allowing an attacker to compromise confidentiality, integrity, and availability of the entire application or system.

The vulnerability affects the php:frankenphp product in versions from 1.11.2 up to, but not including, 1.12.3. Any deployment where an adversary can place or modify content in a file served by FrankenPHP (for example via user uploads, file storage mechanisms, or externally editable directories) is susceptible.

With a CVSS score of 8.1 the flaw is considered High severity. No EPSS data is available, so the likely exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to upload or otherwise place a file into the server’s file system and then reference that file in the URL; the path manipulation is performed entirely locally on the request, so network exposure is not required beyond normal HTTP traffic. Given the high severity and the capability for remote code execution, the risk to affected infrastructures is significant.