CVE-2026-27590
📋 TL;DR
CVE-2026-27590 is a path confusion vulnerability in Caddy server's FastCGI handling that occurs when processing Unicode characters in request paths. Attackers can manipulate file execution to run non-PHP files as PHP code, potentially leading to remote code execution. This affects Caddy servers using FastCGI with PHP before version 2.11.1.
💻 Affected Systems
- Caddy
📦 What is this software?
Caddy by Caddyserver
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if attackers can upload files and execute them as PHP.
Likely Case
Unauthorized file execution allowing attackers to read sensitive files or execute arbitrary code in PHP contexts.
If Mitigated
Limited impact with proper file upload restrictions and execution controls in place.
🎯 Exploit Status
Exploitation requires understanding of Unicode character manipulation and FastCGI path handling. Attackers need ability to upload files or control file contents in some deployments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.1
Vendor Advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96g
Restart Required: Yes
Instructions:
1. Stop Caddy service. 2. Update to version 2.11.1 or later using your package manager or download from GitHub releases. 3. Restart Caddy service.
🔧 Temporary Workarounds
Disable FastCGI PHP processing
allRemove or disable FastCGI configuration for PHP if not required
Edit Caddyfile to remove or comment out php_fastcgi directives
Restrict file uploads
allImplement strict controls on file upload functionality
🧯 If You Can't Patch
- Implement WAF rules to block requests containing Unicode characters in paths targeting PHP files
- Restrict file permissions and implement strict file upload validation with whitelisted extensions only
🔍 How to Verify
Check if Vulnerable:
Check Caddy version and FastCGI configuration. If using FastCGI with PHP and version < 2.11.1, system is vulnerable.Check Version:
caddy versionVerify Fix Applied:
Verify Caddy version is 2.11.1 or later and test FastCGI path handling with Unicode characters.📡 Detection & Monitoring
Log Indicators:
- Unusual Unicode characters in request paths to PHP files
- Multiple failed attempts to access files with special characters
Network Indicators:
- HTTP requests with Unicode characters in paths targeting .php endpoints
- Unusual file execution patterns via FastCGI
SIEM Query:
source="caddy" AND (path:*%* OR path:*\u* OR path:*\x*) AND (path:*.php* OR file:*.php*)