CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Attackers can execute arbitrary code by exploiting unsafe Unicode handling in Caddy's FastCGI module to bypass script extension checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45135?
CVE-2026-45135 is a high-severity code injection vulnerability in caddyserver caddy, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
Which versions are affected by CVE-2026-45135?
3 open source packages ship an affected version, including github.com/caddyserver/caddy/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/caddyserver/caddy/v2 Go | From 2.7.0 | 2.11.3 |
github.com/caddyserver/caddy/v2 Go | From 2.7.0 | 2.11.3 |
github.com/caddyserver/caddy/v2 Go | From 2.7.0 | 2.11.3 |
Products include Caddyserver Caddy.
How do I fix CVE-2026-45135?
Upgrade github.com/caddyserver/caddy/v2 to 2.11.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-45135 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45135 exists.
Other vulnerabilities in caddyserver caddy
- CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
- CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Sources
Also known as CLEANSTART-2026-CJ43596, DEBIAN-CVE-2026-45135, GHSA-m675-2p33-xv9g, GO-2026-5492, MINI-8qh5-r8h3-45gp, UBUNTU-CVE-2026-45135.