CVE-2026-128021
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.