Set cgi.fix_pathinfo=0 in PHP-FPM's php.ini