CVE-2026-27590 in caddy
Summary
by MITRE • 02/24/2026
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/28/2026
The vulnerability CVE-2026-27590 represents a critical path confusion issue within the Caddy web server platform that affects versions prior to 2.11.1. This flaw exists in the FastCGI handling component where the server processes request paths through a flawed path splitting algorithm that creates security implications for applications relying on PHP execution. The vulnerability stems from improper handling of Unicode characters during path processing, specifically when the system performs case conversion operations on UTF-8 encoded strings. The technical implementation involves computing a split index based on a lowercased version of the request path while simultaneously using that index to slice the original path, creating a fundamental mismatch between the computed index and actual byte positions in the original string.
The core technical flaw manifests when Unicode characters with variable byte lengths are processed through the strings.ToLower() function, which can alter the UTF-8 byte count for certain characters. This discrepancy causes the FastCGI path splitting logic to incorrectly calculate where to separate path components, leading to malformed SCRIPT_NAME, SCRIPT_FILENAME, and PATH_INFO variables. When Caddy processes requests containing PHP extensions, this misalignment can cause the server to execute files with different extensions than intended, creating a path confusion scenario where a request targeting a .php file might actually execute a different file on disk. The vulnerability operates at the intersection of string manipulation and file system path resolution, creating opportunities for attackers to exploit the inconsistency between expected and actual file execution paths.
The operational impact of this vulnerability extends beyond simple path confusion to potentially enable remote code execution in environments where attackers can upload or control file contents. This represents a significant security risk because the path confusion can be leveraged to execute unintended PHP code, allowing attackers to bypass normal file extension checks and execute malicious payloads stored in non-.php files. The vulnerability affects deployments where Caddy serves PHP applications through FastCGI, particularly in environments with file upload capabilities or user-controllable content where attackers can place malicious files in strategic locations. Attackers can exploit this by crafting requests that manipulate the path splitting logic to redirect execution to arbitrary files, potentially leading to full system compromise depending on the deployment configuration and file permissions.
The fix implemented in Caddy version 2.11.1 addresses the fundamental issue by correcting the path splitting algorithm to maintain consistent byte indexing regardless of Unicode character handling. This remediation ensures that the split index calculation properly accounts for UTF-8 encoding characteristics and maintains alignment between the processed lowercase path and the original path during slicing operations. The solution aligns with security best practices for Unicode string handling in web applications and follows the principle of least privilege by preventing unauthorized file access through path manipulation. Organizations should prioritize updating to version 2.11.1 or later to mitigate this vulnerability, as the fix resolves the core logic error that enables path confusion attacks and prevents potential remote code execution scenarios. This vulnerability classification aligns with CWE-129 and CWE-707 within the Common Weakness Enumeration framework, representing weaknesses in input validation and improper handling of Unicode data that can lead to security consequences. The ATT&CK framework categorizes this vulnerability under T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter) as it enables attackers to exploit application vulnerabilities to execute arbitrary code through manipulated file paths and PHP execution mechanisms.