DEBIAN-CVE-2026-27590

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-27590

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27590.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-27590

Upstream

CVE-2026-27590

Published

2026-02-24T17:29:04.493Z

Modified

2026-03-11T07:39:20.435664Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower() can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect SCRIPT_NAME/SCRIPT_FILENAME and PATH_INFO, potentially causing a request that contains .php to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-27590

Affected packages

Debian:12 / caddy

Package

Name: caddy
Purl: pkg:deb/debian/caddy?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.6.2-5

2.6.2-6

2.6.2-6.1

2.6.2-7

2.6.2-8

2.6.2-9

2.6.2-10

2.6.2-11

2.6.2-12

2.6.2-13

2.6.2-14

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27590.json"

Debian:13 / caddy