github.com
https://github.com/caddyserver/caddy CVE-2026-27590
HIGH
Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
Record summary
CVE-2026-27590 has a selected CVSS score of 8.9 (high).
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 27, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 2.11.1 | affected | |
github.com/caddyserver/caddy/v2Browse Go / github.com/caddyserver/caddy/v2 | GitHub Advisory | Before 2.11.1 · Fixed in 2.11.1 | affected |
References
6github.com
https://github.com/caddyserver/caddy/releases/tag/v2.11.1 github.comConfirmation
https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g github.com
https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-27590 pkg.go.dev
https://pkg.go.dev/vuln/GO-2026-4536