Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
caddyserver caddy — Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H N N U H H H 8.1 .0050 40.8 —
AFFECTED
Product Versions Fixed
caddy >= 2.7.0, < 2.11.3 – —
TIMELINE
May 8 Reserved by GitHub_M
Jun 23 EXPLOIT PUBLISHED — CVE-2026-45135 (caddyserver caddy). Public exploit reference added.
Jun 23 Published (CNA: GitHub_M)
Description
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 8, 2026 | Reserved | Reserved by GitHub_M |
| June 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-45135 (caddyserver caddy). Public exploit reference added. |
| June 23, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| caddyserver | caddy | — | >= 2.7.0, < 2.11.3 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45135 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.