{"id":"EUVD-2026-38560","enisaUuid":"dcc23608-c83b-32b9-844d-28965ae1158d","description":"Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport\u0027s splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy\u0027s FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.","datePublished":"Jun 23, 2026, 5:56:42 PM","dateUpdated":"Jun 23, 2026, 6:30:27 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g\n","aliases":"CVE-2026-45135\nGHSA-m675-2p33-xv9g\n","assigner":"GitHub_M","epss":0.68,"enisaIdProduct":[{"id":"114f6712-1aff-3a41-a4a9-ce1975c37e95","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"2.7.0, \u003c 2.11.3"}],"enisaIdVendor":[{"id":"edcd7ed4-3bfe-3380-bb97-4450786178b6","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"7e85d53d-3bd5-3217-8aba-ddaa32bce80d","vulnerability":{"id":"CVE-2026-45135","description":"Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport\u0027s splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy\u0027s FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.","datePublished":"Jun 23, 2026, 5:56:42 PM","dateUpdated":"Jun 23, 2026, 6:30:27 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g\n","enisa_id":"EUVD-2026-38560\n","assigner":"GitHub_M","epss":0.68,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"10ce8042-2f2e-3a8a-af5f-9285088a31e4","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"2.7.0, \u003c 2.11.3"}],"vulnerabilityVendor":[{"id":"a822562b-20ca-3533-8e7c-2b8d1f030616","vendor":{"name":"caddyserver"}}]}},{"id":"be40955d-dc1d-3772-8d37-c1267f9e3956","vulnerability":{"id":"GHSA-m675-2p33-xv9g","description":"Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files","datePublished":"May 18, 2026, 1:40:58 PM","dateUpdated":"Jul 20, 2026, 1:42:54 PM","baseScore":0.0,"references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g\nhttps://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm\nhttps://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45135\nhttps://github.com/caddyserver/caddy\n","enisa_id":"EUVD-2026-38560\n","aliases":"GHSA-m675-2p33-xv9g\nCVE-2026-45135\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}