PT-2026-41687 · Caddy · Caddy

Chenjj + 1 · CVE-2026-45135 · Published 2026-05-18 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caddy versions 2.7.0 through 2.11.2

Description The FastCGI transport's splitPos() function in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses the search.IgnoreCase feature of the golang.org/x/text/search library when a request path contains non-ASCII bytes. This leads to two flaws: a control-flow issue where a stale match variable allows non-script files to be treated as scripts, and a Unicode equivalence issue where non-ASCII lookalike characters are folded into ASCII characters (e.g., treating .𝗽𝗵𝗽 as .php). In deployments where an attacker can upload or place content into files served via FastCGI, these flaws can be exploited by crafting a specific URL to achieve remote code execution.

Recommendations Update to version 2.11.3.

Exploit

Fix

RCE

Weakness Enumeration

CWE-178

CWE-20

CWE-176

Related Identifiers

CVE-2026-45135

GHSA-M675-2P33-XV9G

GO-2026-5492

Affected Products

Caddy

References · 18

• 🔥 https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45135.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45135 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5492 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m675-2p33-xv9g · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45135 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45135 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45135 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45135 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45135 · Vendor Advisory
• https://github.com/caddyserver/caddy/pull/7629 · Note
• https://github.com/caddyserver/caddy · Note
• https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 · Note
• https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm · Note