Caddy
CVE-2026-27590
CRITICAL
GHSA-5r3v-vc8m-m96g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft request with Unicode characters
-
DeliveryToLower() changes UTF-8 byte length
-
ExploitByte index mismatch splits path incorrectly
-
ExecutionSCRIPT_NAME/PATH_INFO confused
-
ImpactExecute unintended PHP file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Caddy FastCGI backend enabled with PHP execution. Attacker must craft request paths containing Unicode characters where ToLower() changes byte length (e.g., Turkish ı, German ß). No authentication or special configuration required beyond FastCGI protocol support. |
| Impact | CVSS 9.8, PoC available. Caddy + PHP-FPM is a common deployment — path splitting can bypass authentication or access restricted PHP files. |
| Exploit ScenarioDerived | Attacker sends crafted URL that causes Caddy to split SCRIPT_NAME/PATH_INFO incorrectly, executing a different PHP script than intended by the URL. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to FastCGI backends (PHP-FPM). EPSS 0.19% with PoC available.
Earlier versions of this analysis (1)
FastCGI path splitting in Caddy enables request smuggling.
RemediationAI
Update to Caddy 2.11.1.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 in Caddy's FastCGI reverse proxy. Path splitting allows manipulating SCRIPT_NAME/PATH_INFO splitting sent to PHP-FPM, enabling access to unintended PHP scripts.
Know when Caddy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower() can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect SCRIPT_NAME/SCRIPT_FILENAME and PATH_INFO, potentially causing a request that contains .php to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
Executive ViewAI
A critical vulnerability in Caddy web servers (CVE-2026-27590, CVSS 9.8) enables attackers to bypass security controls and execute arbitrary code through malformed FastCGI requests. Organizations running Caddy versions prior to 2.11.1 face immediate risk of compromise, particularly those exposing FastCGI functionality to untrusted networks.
Disable FastCGI module if not required for operations; implement network segmentation to restrict FastCGI request sources to trusted systems only; deploy WAF rules to filter requests with path traversal patterns and lowercased path anomalies; enable request logging and alerting for suspicious FastCGI traffic; consider using reverse proxy authentication to limit exposure; monitor vendor advisories for patch release timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers
A configuration-gated information-disclosure flaw in Caddy 2.11.3 and earlier allows an unauthenticated remote attacker
Caddy versions prior to 2.11.1 fail to sanitize backslashes in file path matching, allowing attackers to bypass path-bas
Caddy versions prior to 2.11.1 allow unauthenticated cross-origin requests to the admin API when origin enforcement is d
An issue was discovered in caddy (for TYPO3) before 7.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remo
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumer
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB