CVE-2026-27590: Caddy: Unicode case-folding length change causes split_path index confusion in FastCGI transport
Caddy computes the FastCGI path split index on a lowercased copy of the request path and applies it to the original path. Because some Unicode characters change byte length when lowercased, SCRIPT_NAME, SCRIPT_FILENAME and PATH_INFO can be derived incorrectly, which may lead to path confusion. The record states the issue is fixed in version 2.11.1.
Overview
Caddy computes the FastCGI split point on a lowercased copy of the request path and then applies that byte index to the original path. Some Unicode characters change their UTF-8 byte length when lowercased, so the index can point to the wrong position. The record states this can lead to incorrectly derived SCRIPT_NAME, SCRIPT_FILENAME and PATH_INFO values.
Impact
- A request containing .php may be mapped to a different file on disk than the one intended (path confusion).
- Where an attacker can control file contents, for example through upload features, non-.php files may be processed by PHP. The record describes this as potential remote code execution depending on deployment.
- The actual impact depends on the deployment, which the record does not describe.
Affected products and versions
- Product: Caddy (Caddyserver Caddy).
- Affected versions: before 2.11.1, according to the CNA and NVD data in the record.
- Fixed version: 2.11.1, as stated in the record description and the release reference.
Exploitation status
- The record shows this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation is reported in the sources consulted.
- The record includes an SSVC exploitation value of poc, which refers to proof-of-concept availability and is not evidence of exploitation in the wild.
- The EPSS probability in the record is 0.00962 with a percentile of 0.61281.
Remediation and mitigation
- Upgrade Caddy to version 2.11.1 or later.
- After upgrading, confirm the running build and review the release notes linked in the references.
- If upgrading is delayed, reduce exposure of upload features that allow files to be placed in web-served locations, and review how PHP handlers are mapped to file types. This is a general hardening suggestion, not a verified workaround from the sources.
- Ensure that FastCGI runtimes only process the file types the application intends to execute.
Detection guidance
- Review web server logs for requests with .php in the path where the resolved script or path info looks unexpected for the application.
- Identify uploaded files with non-PHP extensions that are reachable by URL and handled by PHP.
- Watch for unusual Unicode characters in request paths as a signal worth reviewing. This is not a confirmed indicator of exploitation.
Limitations of the available information
- The record does not list specific vulnerable deployments or any preconditions beyond the description.
- The fixes field in the record is empty; the fixed version is taken from the description and the release reference.
- The vendor advisory and the third-party FrankenPHP advisory were not retrieved; this analysis relies on the record.
- No CVSS-based environment-specific risk assessment can be made from the data available.
Frequently asked questions
What causes CVE-2026-27590 in Caddy?
According to the record, Caddy computes the FastCGI split index on a lowercased copy of the request path and applies it to the original path. Some Unicode characters change byte length when lowercased, which can produce incorrect SCRIPT_NAME, SCRIPT_FILENAME and PATH_INFO values.
Which Caddy versions are affected?
The record lists Caddy versions before 2.11.1 as affected. The fix is stated to be version 2.11.1.
Is this vulnerability known to be actively exploited?
No. The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.