What is the CVSS score of CVE-2026-24895?

CVE-2026-24895 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-24895?

FrankenPHP versions prior to 1.11.2 contain a critical vulnerability enabling remote code execution through improper Unicode handling in path processing.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24895?

Yes, a public proof-of-concept exploit is available for CVE-2026-24895. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24895?

Within 24 hours: Identify all systems running FrankenPHP and document versions; isolate or restrict external access to affected instances. Within 7 days: Apply vendor patch to upgrade FrankenPHP to version 1.11.2 or later across all production and non-production environments. Within 30 days: Conduct security audit of patched systems and review access logs for exploitation attempts during the vulnerability window.

PHP CVE-2026-24895

CRITICAL

Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)

2026-02-12 security-advisories@github.com

GHSA-g966-83w7-6w38

PHP Golang Frankenphp Suse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 20, 2026 - 18:30 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 18:30 nvd

Patch available

CVE Published

Feb 12, 2026 - 20:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

AnalysisAI

CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI processing. PoC and patch available.

Technical ContextAI

CWE-180 in FrankenPHP's CGI path splitting. Unicode normalization differences allow bypassing path validation.

RemediationAI

Update to FrankenPHP 1.11.2.

More in PHP

View all

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2018-11138 CRITICAL Emergency POC

9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-46506 CRITICAL Emergency POC

10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro

Same weakness CWE-180 – Incorrect Behavior Order: Validate Before Canonicalize

View all

CVE-2026-39364 HIGH POC

8.2

CVE-2026-69246 HIGH POC

7.2

CVE-2026-69245 MEDIUM POC

6.5

CVE-2022-26136 CRITICAL

9.8

CVE-2026-73420 CRITICAL

9.1

CVE-2022-26137 HIGH

8.8

CVE-2026-52747 HIGH

8.6

CVE-2026-48721 HIGH

8.6

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-24895 vulnerability details – vuln.today

Back

PHP CVE-2026-24895

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in PHP

Same weakness CWE-180 – Incorrect Behavior Order: Validate Before Canonicalize

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code