ETK-2026-3685Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3685",
  "cve_id": null,
  "display_id": "ETK-2026-3685",
  "ghsa_id": "GHSA-j99q-3wr8-xj43",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Path validation bypass causing PHP execution in FrankenPHP",
  "summary": "FrankenPHP php_server versions before 1.13.5 can treat certain non-script files under the document root as PHP because request-path matching can disagree with configured split-extension handling. An attacker able to upload or otherwise create files with chosen names or directories beneath the document root may cause those files to be executed by PHP when they are requested. Exploitation also requires the affected path to be reachable through the PHP handler.",
  "mitigation": "Upgrade github.com/dunglas/frankenphp to version 1.13.5 or later. Until upgraded, keep uploads outside the document root or route upload directories away from the PHP handler, and reject non-ASCII names and directory names containing configured split extensions.",
  "vendor": "go",
  "product": "go:github.com/dunglas/frankenphp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.13.4"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.13.5"
      ],
      "package_name": "github.com/dunglas/frankenphp",
      "purl": "pkg:golang/github.com/dunglas/frankenphp"
    }
  ],
  "cwes": [
    436
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 6.340928,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-06T00:28:28.345481+00:00",
      "days": -0.3392213688773148,
      "is_lower_bound": true,
      "measured_at": "2026-11-06T08:36:57.115137+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-05T12:01:47+00:00",
      "days": -0.8577554600925926,
      "is_lower_bound": true,
      "measured_at": "2026-11-06T08:36:57.115137+00:00",
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-j99q-3wr8-xj43"
    },
    "trigger_signal": {
      "at": "2026-11-05T12:01:47+00:00",
      "days": -0.8577554600925926,
      "is_lower_bound": true,
      "measured_at": "2026-11-06T08:36:57.115137+00:00",
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-j99q-3wr8-xj43"
    }
  }
}