Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Caddy Web Server Improper Input Validation Vulnerability - CVE-2026-27590 - Vulnerability Database
Caddy Web Server

Caddy Web Server Improper Input Validation Vulnerability - CVE-2026-27590

Critical
Reference: CVE-2026-27590
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-27590
Title: Caddy Web Server Improper Input Validation Vulnerability
Overview:

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1 Caddy39s FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower() can change UTF-8 byte length for some characters. As a result Caddy can derive an incorrect SCRIPT_NAME/SCRIPT_FILENAME and PATH_INFO potentially causing a request that contains .php to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g. upload features) this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.