Aller au contenu
en Se connecter
8.9 Élevée

CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default

Description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
caddy 2.11 premières → < 2.11.1 2.11.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de caddy

Les 17 CVE de caddy →
CVE-2026-55458 Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through 2.9 Faible CVE-2026-92700 Caddy is an extensible server platform that uses TLS by default 6.3 Moyenne CVE-2026-92284 Caddy is an extensible server platform that uses TLS by default 6.9 Moyenne CVE-2026-77281 Caddy is an extensible server platform that uses TLS by default 6.5 Moyenne
Suivre cette CVE