CVE-2026-45135: Caddy FastCGI Path Splitting Remote Code Execution

Technical summary

The vulnerability stems from improper use of golang.org/x/text/search with the IgnoreCase flag in the FastCGI transport's splitPos() function (fastcgi.go). When a request path contains non-ASCII bytes, two distinct logic flaws in the fallback behavior allow path-based script detection to be bypassed. The splitPos() function is responsible for determining where to split the request path to identify the script portion for FastCGI processing. By crafting a URL with specific non-ASCII characters, an attacker can cause Caddy to misclassify files—treating arbitrary content as PHP scripts (or other configured CGI extensions) even when the file lacks the expected extension. This misclassification, combined with the ability to control file content, enables arbitrary code execution within the FastCGI handler context.

Business impact

Organizations running Caddy as a reverse proxy or application server face direct code execution risk if they: (1) serve user-uploaded content via FastCGI, (2) host multi-tenant applications where untrusted users can write files to the web root, or (3) use FastCGI to execute scripts in directories containing untrusted or mixed content. Successful exploitation could lead to data theft, lateral movement within the network, service disruption, or complete server compromise. Downtime for patching and incident investigation could impact availability, and potential data breaches could trigger regulatory reporting obligations.

Affected systems

Caddy versions 2.7.0 through 2.11.2 are vulnerable. The flaw specifically affects deployments using the FastCGI reverse proxy module with split_path directives. Versions prior to 2.7.0 and version 2.11.3 and later are not affected. Organizations should audit their Caddy installations to determine which versions are in use and whether FastCGI modules are active in production configurations.

Exploitability

Exploitation requires two preconditions: (1) the ability to place or control file content served through a FastCGI-enabled Caddy instance (via uploads, shared storage, or file storage features), and (2) the ability to craft and send HTTP requests to the Caddy server. The attack does not require authentication or interaction from end users. The complexity is rated as 'high' in the CVSS metric, likely because the attacker must craft a specific non-ASCII payload that triggers one of the two logic flaws in splitPos(). Once successful, the attacker gains code execution with the privileges of the Caddy process.

Remediation

Upgrade Caddy to version 2.11.3 or later. Before upgrading, operators should review their Caddyfile configurations to identify which services use the FastCGI reverse proxy module and which directories are subject to user uploads or untrusted content. After patching, re-test the affected services to ensure script execution continues to work as expected. In the interim, consider restricting who can upload files to directories served via FastCGI, disabling FastCGI for directories containing untrusted content, or moving file uploads to a separate application server not relying on path-based script splitting.

Patch guidance

Caddy 2.11.3 fixes both flaws in the splitPos() function's handling of non-ASCII path characters. Administrators should: (1) review the Caddy GitHub releases page to obtain version 2.11.3 or the latest stable build, (2) perform a staged rollout—test the upgrade in a non-production environment first to verify compatibility with existing configurations and script execution, (3) monitor FastCGI logs and application behavior post-upgrade for any unexpected changes in script routing, and (4) update documentation or runbooks if FastCGI split_path rules were working around this issue.

Detection guidance

To identify exploitation attempts, monitor HTTP access logs for requests to FastCGI-handled paths containing non-ASCII or unusual byte sequences (percent-encoded characters), particularly those that do not match typical user-generated content patterns. Review FastCGI handler logs for unexpected attempts to execute files without the configured script extension (e.g., requests to execute .txt, .jpg, or other non-.php files as scripts). Intrusion detection systems should flag HTTP requests with non-ASCII characters in the path directed at FastCGI endpoints. File integrity monitoring on script directories can detect unauthorized file placement or modification. Query web server logs for requests that would only make sense if non-script files were being executed.

Why prioritize this

This vulnerability merits high priority because it enables unauthenticated remote code execution in a widely-used server platform, requires only file upload capabilities (a common feature), and affects a production-relevant code path (FastCGI request routing). The CVSS 8.1 score reflects high impact (confidentiality, integrity, and availability) even though exploit crafting complexity is non-trivial. Organizations with public-facing or multi-tenant Caddy instances should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: high impact across confidentiality, integrity, and availability (remote code execution on the server); network-accessible attack vector; no privilege or user interaction required; and isolated scope (the vulnerability does not extend beyond the affected component). The 'high' attack complexity accounts for the need to craft a specific non-ASCII payload and the requirement to control file content, which raises the bar above trivial exploitation but remains feasible in environments with file uploads or shared storage.

Frequently asked questions