Paper/Archive/CVE-2026-128027

CVE-2026-128027

php frankenphp — FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.

Affected

ProductAffectedFixed inSource

frankenphp< 1.1.111.1.11CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

advisorygithub.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf writeupvulncheck.com/advisories/frankenphp-before-1.1.11-delayed-propagation-of-base-image-security-fixes