Skip to content
Threat Feed
Subscribe

Vendor

Dunglas

2 briefs RSS
high advisory

FrankenPHP Cross-Request Session ID Leak in Worker Mode

A build-time dependency issue in FrankenPHP causes cross-user session ID leakage when the PHP session extension is loaded as a shared module in worker mode.

FrankenPHP web-application session-management vulnerability
1c
high advisory

FrankenPHP Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

Two distinct flaws in the `splitPos()` function in `cgi.go` allows an attacker to mislead FrankenPHP into treating a non-`.php` file as a `.php` script, leading to remote code execution where the attacker can control file content.

frankenphp unicode remote code execution web server
2r 1t 1c