FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
Summary
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVE...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| phpfrankenphp |
< 1.13.4→ 1.13.4 |
1.13.4 |
Original description The description as published by the source.
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
Source: CVE.org (CVE Program・cvelistV5) NVD