FrankenPHP leaks session data between requests in worker mode

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

N/A

特权管理不恰当

FrankenPHP 代码问题漏洞

FrankenPHP是phpnet开源的一个PHP应用服务器。 FrankenPHP 1.11.2之前版本存在代码问题漏洞，该漏洞源于在worker模式下运行时，$_SESSION超全局变量未在请求间正确重置，可能导致后续请求访问先前请求的会话数据。

N/A

N/A