ID
VAR-202606-5937
CVE
CVE-2026-45135
TITLE
Light Code Labs of Caddy Multiple vulnerabilities in
Trust: 0.8
DESCRIPTION
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3. ASCII If it contains bytes golang.org/x/text/search of search.IgnoreCase I was misusing it. URL Creating this could lead to remote code execution. This vulnerability is in version 2.11.3 has been fixed.- All information handled by the software may be leaked to external parties. - All information handled by the software may be overwritten. - The software may completely shut down
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | caddyserver | model: | caddy | scope: | gte | version: | 2.7.0 | Trust: 1.0 |
| vendor: | caddyserver | model: | caddy | scope: | lt | version: | 2.11.3 | Trust: 1.0 |
| vendor: | light code | model: | caddy | scope: | - | version: | - | Trust: 0.8 |
| vendor: | light code | model: | caddy | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | light code | model: | caddy | scope: | eq | version: | 2.7.0 that's all 2.11.3 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-178 | Trust: 1.0 |
| problemtype: | CWE-20 | Trust: 1.0 |
| problemtype: | CWE-176 | Trust: 1.0 |
| problemtype: | Unicode Improper handling of encoding (CWE-176) [ others ] | Trust: 0.8 |
| problemtype: | Improper case sensitivity (CWE-178) [ others ] | Trust: 0.8 |
| problemtype: | Inappropriate input confirmation (CWE-20) [ others ] | Trust: 0.8 |
PATCH
| title: | Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files Advisory caddyserver/caddy GitHub | url: | https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2026-45135 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2026-021347 | Trust: 0.8 |
REFERENCES
| url: | https://github.com/caddyserver/caddy/security/advisories/ghsa-m675-2p33-xv9g | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2026-45135 | Trust: 0.8 |
SOURCES
| db: | JVNDB | id: | JVNDB-2026-021347 |
| db: | NVD | id: | CVE-2026-45135 |
LAST UPDATE DATE
2026-06-30T23:47:13.847000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2026-021347 | date: | 2026-06-29T02:17:00 |
| db: | NVD | id: | CVE-2026-45135 | date: | 2026-06-26T18:04:10.390 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2026-021347 | date: | 2026-06-29T00:00:00 |
| db: | NVD | id: | CVE-2026-45135 | date: | 2026-06-23T18:17:52.343 |