Detections
Analytics

SCA: security update for github.com/dunglas/frankenphp (GHSA-v3ph-cgqh-r8p5)

high Tenable Self-Hosted Container Security Plugin ID 474692

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP
 session state between requests when the session extension is loaded as a shared module and is unavailable
 through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is
 compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new
 request's cookie because an identifier is already present. Under concurrent requests, session_id() can
 therefore return another client's identifier or a stale identifier from a previous request on the same
 worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout
 behavior. Builds with the session extension statically linked, including the official static binaries and
 Docker images, are not affected. This issue is fixed in version 1.12.5. (CVE-2026-82416)

Solution

Update the github.com/dunglas/frankenphp library and its related packages to version 1.12.5 or later.

See Also

https://github.com/advisories/GHSA-v3ph-cgqh-r8p5

Plugin Details

Severity: High

ID: 474692

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.72

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.3

Temporal Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2026-82416

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-82416