CVE-2026-45135 Details
Description
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
A vulnerability in Caddy's FastCGI transport, affecting versions 2.7.0 through 2.10.2, allows for remote code execution due to improper handling of Unicode characters in request paths. The issue arises in the 'splitPos()' function of the FastCGI module, where non-ASCII bytes are mismanaged, enabling an attacker to manipulate how Caddy interprets file paths. This flaw can be exploited by crafting a URL that triggers the improper path handling, particularly in environments where the attacker can upload files that are processed by FastCGI.
Users can upgrade to Caddy version 2.11.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g | CISA-ADP | ExploitVendor Advisory |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-176 | Improper Handling of Unicode Encoding | [email protected] |
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | >= 2.7.0, < 2.11.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |