CVE-2026-27590 is a critical flaw (CVSS 9.8) in Caddy. Its FastCGI path splitting can pick the wrong script for a request containing .php, and where attackers control file contents that can mean unintended PHP execution. Upgrade to Caddy 2.11.1 or later.
What's affected
Caddy before 2.11.1, in setups that use the FastCGI transport, typically for PHP. The record says the impact becomes serious where an attacker can influence file contents, for example through an upload feature, and calls the result potential remote code execution depending on deployment.
The advisory also says the affected logic was copied or adapted from Caddy into FrankenPHP, which has its own advisory. If you run FrankenPHP, check that project's guidance too.
GitHub advisories for these Caddy issues list v2.11.0 as the patched version, but the release notes say the first 2.11 release was published as v2.11.1, with no code changes from v2.11.0 other than a CI job. Plan on v2.11.1 or later.
KEV is false in the record.
How to check if you're exposed
Check the version and look for PHP handling.
caddy version
grep -rn "php_fastcgi\|fastcgi" /etc/caddy/
If you find FastCGI handling, check whether users can upload files into any directory under the document root. Non PHP files that carry attacker controlled content are the pieces that matter here.
What to do now
- Upgrade to Caddy 2.11.1 or later, and to a fixed FrankenPHP release if you use it.
- Store uploads outside the document root, or in a location the FastCGI handler cannot reach.
- Do not allow user uploads in paths served through PHP at all.
- Review upload directories for unexpected files with names containing .php.
- Reduce the privileges of the PHP process so a mistake has a small blast radius.
Why it matters
The advisory explains the cause. Caddy lowercases the request path, finds the position of the split marker in the lowercased copy, then uses that byte position on the original path. For some Unicode characters, lowercasing changes the length in bytes, so the position no longer lines up. The resulting script name and path info are wrong, which is CWE-180, validation done before canonicalisation, together with CWE-20, improper input validation.
A path that points to the wrong file is a classic way to turn a harmless upload into code that runs. Fixing the index calculation closes the gap in Caddy.
Quick check
Does this affect Caddy installs that do not serve PHP?
The advisory ties the issue to FastCGI path splitting. If you do not use FastCGI, this bug is not on your path.
Sources
Last reviewed: 19 October 2026.
