Security readout for executives and security teams
Plain-English summary
CVE-2026-27590 affects Caddy before 2.11.1 when handling FastCGI path splitting for PHP-style requests. A Unicode lowercasing bug can make Caddy split paths incorrectly, potentially causing the wrong file to be treated as executable PHP. Risk is highest where users can upload or influence files on the web server.
Executive priority
High priority for organizations running Caddy with PHP/FastCGI, especially public sites with uploads. Patch promptly because the issue may allow unintended PHP execution. Lower priority only where Caddy is not used, not internet-facing, or not configured with relevant FastCGI path handling.
Technical view
Caddy computed a split index on a lowercased request path, then applied that byte index to the original UTF-8 path. Some Unicode case-folding changes byte length, creating SCRIPT_NAME, SCRIPT_FILENAME, and PATH_INFO confusion. In affected FastCGI setups, a request containing .php may execute a different on-disk file than intended. Fixed in Caddy 2.11.1.
Likely exposure
Internet-facing Caddy deployments before 2.11.1 using FastCGI path splitting, especially for PHP, are the primary concern. Exposure increases if the application permits uploads or attacker-controlled file content. The provided sources identify Caddy as affected; do not assume unrelated products are vulnerable without vendor confirmation.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS vector marks exploit maturity as proof-of-concept, and the described impact can reach remote code execution depending on deployment. Treat as urgent for PHP/FastCGI sites with upload functionality.
Researcher notes
Evidence is sufficient for affected version and fix: Caddy before 2.11.1, fixed in 2.11.1. The supplied description links impact to Unicode case-folding length expansion and FastCGI variable confusion. Active exploitation is not established in the provided sources.
Mitigation direction
- Upgrade Caddy to version 2.11.1 or later.
- Prioritize internet-facing FastCGI/PHP deployments.
- Review Caddy and related vendor advisories for deployment-specific guidance.
- Reduce or isolate attacker-controlled file upload paths where feasible.
Validation and detection
- Inventory Caddy versions and flag anything before 2.11.1.
- Identify sites using Caddy FastCGI path splitting for PHP.
- Check whether users can upload or modify served files.
- Confirm upgraded hosts report Caddy 2.11.1 or later.
- Review logs for unusual Unicode paths containing .php.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-180: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27590 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.9HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/caddyserver/caddy/security/advisories/GHSA-5r3v-vc8m-m96gCVE reference · x_refsource_CONFIRM
- https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38CVE reference · x_refsource_MISC
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Behavior Order: Validate Before Canonicalize
Incorrect Behavior Order: Validate Before Canonicalize represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.