SEC.co
Emergency

By vendor

Caddyserver vulnerabilities

Known CVEs affecting Caddyserver products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-45135HIGH 8.1

    Caddy, a popular TLS-enabled web server platform, contains a flaw in its FastCGI request routing logic that could allow an attacker to execute arbitrary code on affected servers. The vulnerability exists when Caddy processes HTTP requests with non-ASCII characters in the path. An attacker who can upload files or control content served through FastCGI can exploit this misconfiguration to trick Caddy into treating non-script files (like images or documents) as executable scripts, leading to remote code execution. The issue affects versions 2.7.0 through 2.11.2 and is resolved in version 2.11.3.

  • CVE-2026-45692MEDIUM 5.4

    Caddy, a popular open-source web server known for automatic HTTPS, contains a path traversal vulnerability affecting versions 2.4.0 through 2.11.2. The vulnerability arises from a disagreement between two critical layers: the authorization system checks permissions using simple text matching, while the configuration API parses the same paths using numerical array indexing. An attacker with valid credentials can exploit this mismatch to access configuration objects they shouldn't be able to reach. For example, a user authorized to view `/config/servers/0` might be able to access `/config/servers/1` by manipulating how indices are parsed. The flaw requires authentication, so it primarily affects scenarios where multiple users or services share a Caddy instance.