← Vulnerability feed

Vulnerability record · CVE-2026-27590 · published 24 February 2026

CVE-2026-27590: Caddyserver caddy improper input validation vulnerability

Caddyserver · Caddy

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

8.9 CVSS 4.0 High EPSS 0.86% · top 43.1% CWE-20 · Improper input validationCWE-180 · CWE-180
8.9CVSS 4.0 base score
0.86%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/caddyserver/caddy/releases/tag/v2.11.1 Release Notes
https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g ExploitVendor Advisory
https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 Third Party Advisory

Track CVE-2026-27590 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2018-21246Caddyserver caddy improper authentication vulnerabilityCaddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching m…EPSS 2.7%8.8CVE-2026-30851Caddyserver caddy improper authentication vulnerabilityCaddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not str…EPSS 0.35%8.8CVE-2026-27586Caddyserver caddy vulnerabilityCaddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` …EPSS 0.40%8.1CVE-2026-52845Caddyserver caddy improper authentication vulnerabilityCaddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identit…EPSS 0.45%8.1CVE-2026-45135Caddyserver caddy improper input validation vulnerabilityCaddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/rev…EPSS 0.68%7.7CVE-2026-27588Caddyserver caddy vulnerabilityCaddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-i…EPSS 0.54%7.7CVE-2026-27587Caddyserver caddy vulnerabilityCaddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2026-27590), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.