CVE-2026-27590Disclosure(caddyserver / caddy)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch caddyserver caddy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

caddyserver CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g

Vendor / third-party advisories

https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38

Other references

https://github.com/caddyserver/caddy/releases/tag/v2.11.1

Weakness type (CWE)

CWE-20CWE-180

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

caddy

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-02-25); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

caddyserver

Products

caddy

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-24	1	Disclosure1
2026-02-25	2	Disclosure1General1
2026-02-26	1	Patch1

Full discourse4 posts

PulsePatch.io@pulsepatchio227d
Patch
`Caddy` versions prior to 2.11.1 contain a FastCGI path splitting logic vulnerability (CVE-2026-27590). Update to mitigate potential access bypasses and unintended resource exposure. #Caddy #Webserver #infosec https://www.pulsepatch.io/posts/cve-2026-27590-caddy-fastcgi-path-splitting
Post summary
Caddy versions prior to 2.11.1 are vulnerable to a FastCGI path splitting flaw (CVE-2026-27590); users should update to mitigate potential access bypasses and unintended resource exposure.
0000043
1 followersView on X
The Hacker Wire@TheHackerWire228d
Disclosure
🔴 CVE-2026-27590 - Critical Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request... https://www.thehackerwire.com/vulnerability/CVE-2026-27590/ https://t.co/MEewTeS51z
Post summary
The post announces CVE-2026-27590, a critical vulnerability in Caddy’s FastCGI path splitting logic, but does not provide PoC, exploit, or patch details.
0000068
116 followersView on X
CVE@CVEnew228d
General
CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercase… https://www.cve.org/CVERecord?id=CVE-2026-27590
Post summary
The snippet references CVE-2026-27590, noting a flaw in Caddy's FastCGI path splitting logic, but provides no evidence of exploitation, PoC, or patch.
00000139
56.6K followersView on X
cvereports@_cvereports229d
Disclosure
CVE-2026-27590: Lost in Translation: Unicode Path Confusion in Caddy & FrankenPHP A critical logic flaw in Caddy's FastCGI transport layer allows for Remote Code Execution (RCE) via Unicode case-folding collisions. By exploiting how Go's `strings.ToLo... https://cvereports.com/reports/CVE-2026-27590
Post summary
The report highlights a critical logic flaw in Caddy’s FastCGI transport layer that enables remote code execution through Unicode case‑folding collisions, but it does not provide a PoC, exploit, patch, or evidence of active exploitation.
0000048
31 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	caddyserver	caddy	-	-	-

Explore more

Back to dashboard caddyserver CVEs caddy vulnerabilities

What researchers are saying

CVE-2026-27590

PulsePatch.io@pulsepatchioPatch

Caddy versions prior to 2.11.1 are vulnerable to a FastCGI path splitting flaw (CVE-2026-27590); users should update to mitigate potential access bypasses and unintended resource exposure.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-27590, a critical vulnerability in Caddy’s FastCGI path splitting logic, but does not provide PoC, exploit, or patch details.

CVE@CVEnewGeneral

The snippet references CVE-2026-27590, noting a flaw in Caddy's FastCGI path splitting logic, but provides no evidence of exploitation, PoC, or patch.

cvereports@_cvereportsDisclosure

The report highlights a critical logic flaw in Caddy’s FastCGI transport layer that enables remote code execution through Unicode case‑folding collisions, but it does not provide a PoC, exploit, patch, or evidence of active exploitation.