FrankenPHP, the modern PHP application server, is shipped in official Debian and Alpine Docker images that contain a default /app/public/index.php script which executes phpinfo(). When the container is run, this script is served automatically, displaying diagnostic data such as environment variables, secrets, PHP configuration settings, loaded extensions, software versions, and system paths. The exposed placeholder creates an information disclosure flaw that allows anyone who can reach the container’s HTTP endpoint to view sensitive configuration data. The weakness is identified as CWE‑200, Information Exposure.

The vulnerability affects all official FrankenPHP Docker images based on Debian and Alpine that were built before version 1.12.5 and that do not provide a custom /app/public/index.php. Derived images that do not override the placeholder remain affected until rebuilt or updated. Users of FrankenPHP 1.12.5 and later are not impacted because the new release removes the default phpinfo page.

The CVSS score of 5.3 indicates moderate severity for this information disclosure. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that wide‑spread exploitation has not been observed. The likely attack vector is a public HTTP request to the container’s default page when the placeholder is present; an attacker who can reach that page can retrieve the sensitive data. Although direct exploitation does not lead to code execution or privilege escalation, the exposure of secrets can enable further attacks at a higher level. The risk is therefore moderate, with mitigation focused on disabling the default phpinfo page before production deployment.