PT-2026-21775 · Caddy · Caddy

Abdrrahimdahmani + 1 · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27590

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 FrankenPHP versions prior to 1.11.2

Description Caddy and FrankenPHP are vulnerable to a path confusion issue due to incorrect handling of Unicode characters during case conversion in the FastCGI path splitting logic. The software computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower() can change UTF-8 byte length for some characters, leading to an incorrect SCRIPT NAME/SCRIPT FILENAME and PATH INFO. This can cause a request containing .php to execute a different on-disk file than intended. In setups where an attacker can control file contents, this can lead to unintended PHP execution of non-.php files, potentially resulting in remote code execution (RCE). The issue stems from the use of the splitPos() function, which calculates the split index based on the byte length of the lowercased path, and then applies this index to the original path. This can lead to a mismatch when Unicode characters that expand when lowercased are present in the path.

Recommendations Caddy versions prior to 2.11.1: Upgrade to version 2.11.1 or later. FrankenPHP versions prior to 1.11.2: Upgrade to version 1.11.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-180

Related Identifiers

CVE-2026-27590

GHSA-5R3V-VC8M-M96G

GHSA-G966-83W7-6W38

GO-2026-4536

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 132

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27590.json · Exploit
• https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g966-83w7-6w38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27590 · Security Note
• https://ubuntu.com/security/CVE-2026-27590 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4536 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27590 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27590 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r3v-vc8m-m96g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24895 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27590 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27590 · Security Note
• https://github.com/caddyserver/caddy · Note