FrankenPHP’s November 5 security release fixes 17 vulnerabilities, including a high-severity flaw that can turn an uploaded file into executable PHP. Version 1.13.5 also updates its bundled Caddy server to 2.11.9.
The most urgent questions for operators are where applications store uploads, how requests reach PHP and whether persistent workers can carry one user’s output into another user’s response.
When an uploaded file becomes a script
GHSA-j99q-3wr8-xj43, rated high with a CVSS 3.1 score of 7.5, affects FrankenPHP through 1.13.4 and is fixed in 1.13.5. Its prerequisites matter: an attacker must be able to place a file with a chosen name or directory beneath the document root.
The flaw comes from disagreement between request routing and script-path interpretation. A directory name containing repeated PHP extensions can route an apparently non-PHP file to the PHP handler, which then executes its contents. The advisory also describes Unicode-related cases involving custom script extensions and Windows path handling.
The maintainers recommend keeping uploaded files outside the document root as a workaround. That separation is especially useful while preparing the upgrade because it removes the attacker-controlled file from the web server’s executable tree.
Request boundaries need attention too
A separate worker-mode advisory describes previous-request code running while the next client’s response is active. Under affected application patterns, output, headers or cookies can reach the wrong user. Examples include session objects with destructors that produce output and error handlers that print request data.
This issue affects versions through 1.13.4; classic mode is unaffected. Version 1.13.5 corrects the cleanup sequence. The advisory also recommends avoiding output-producing session destructors and registering shutdown functions outside the per-request handler.
Another advisory concerns path-based Caddy access rules being evaluated against a different script path from the one FrankenPHP executes. It affects versions through 1.13.4, but configuration determines exposure: the default php_server setup with a root index.php and default try_files is not affected. Custom routing and direct use of the php directive deserve closer review.
Upgrade and check the application behavior
The slow-request-body flaw can let an unauthenticated client occupy every PHP thread with one slow connection per thread. Its advisory lists FrankenPHP 1.12.5–1.13.4 as affected and 1.13.5 as patched. It also notes separately tracked cases involving bodies PHP does not read during request startup, so the update should not be described as eliminating every slow-body scenario.
Before rollout, worker deployments should review the release’s breaking change: only request-derived state is reset between requests, while some error and library state persists. Applications that need a clean state must clear it explicitly. Test upload handling, access restrictions and sequential requests from different users against the updated deployment.
The reviewed disclosures provide reproducible demonstrations, but do not report exploitation in the wild. The highlighted advisories list no known CVE identifiers at publication; their GHSA identifiers provide the direct references.
