Path Confusion Vulnerability in Caddy Server by Caddy Software

CVE-2026-27590

What is CVE-2026-27590?

Prior to version 2.11.1, Caddy Server has a vulnerability in its FastCGI path splitting logic. The challenge arises from the way it computes the split index on a lowercased version of the incoming request path, which may misinterpret UTF-8 byte lengths. This flaw can lead to erroneous derivatives of SCRIPT_NAME, SCRIPT_FILENAME, and PATH_INFO, particularly in scenarios where .php requests could inadvertently match non-.php files. In environments where an attacker controls file contents, such as those with upload capabilities, this can create a risk of executing unintended files, including potential remote code execution depending on the server's configuration.

References