Alexandre-Daubois

FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error list) between requests. Attackers sending requests to the same worker thread can call libxml get errors() or libxml get last error() to obtain other clients' parsed-document fragments and server filesystem paths.

FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.

FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc open or exec can read secrets such as database passwords set by other requests.

An unauthenticated remote attacker can inject terminal escape sequences into the operator's terminal user interface (TUI) by sending HTTP requests with control bytes in the request target to a monitored Caddy server. The issue occurs because the `ParseLogLine` function decodes JSON access logs back into raw bytes, which are then rendered via the `fitCellLeft` helper and row formatters without neutralizing terminal escape or control sequences. This allows the injection of ANSI, OSC, or CSI control bytes that the terminal emulator interprets. Potential impacts include monitoring-dashboard spoofing through cursor and scroll sequences, clipboard hijacking via OSC 52, and window-title spoofing via OSC 0/2. The Certificates and Routes tabs are also affected. Modes using `--json`, `--once`, or `--expose` are not impacted as they do not render to an interactive terminal.

A type confusion issue exists in the serializer's `AbstractItemNormalizer` when resolving relation IRIs (Internationalized Resource Identifiers). The system fails to validate the resource type returned, allowing a resource of an unintended type to be silently assigned to a relation property. An attacker can exploit this by submitting write requests (POST, PUT, or PATCH) to an endpoint with writable relations, providing a relation IRI that points to a resource of a different type than the declared class. This occurs because `getResourceFromIri()` does not pass an `$operation` to `IriConverter::getResourceFromIri()`, causing the `is a` type guard in `IriConverter.php` to be skipped. For untyped relation properties, this can corrupt invariants and affect downstream logic that assumes the declared type.