CVE-2026-128026
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.