Lucene search
K

CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

πŸ—“οΈΒ 23 Jun 2026Β 17:56:42Reported byΒ GitHub_MTypeΒ 
cvelist
Β cvelist
πŸ”—Β www.cve.orgπŸ‘Β 6Β Views

Unsafe Unicode handling in FastCGI split path in Caddy versions 2.7.0 to 2.11.3 enables remote code execution.

Related
Affected
Refs
ReporterTitlePublishedViews
Family
ATTACKERKB
CVE-2026-45135
23 Jun 202617:56
–attackerkb
AlpineLinux
CVE-2026-45135
23 Jun 202617:56
–alpinelinux
Circl
CVE-2026-45135
13 May 202614:39
–circl
CVE
CVE-2026-45135
23 Jun 202617:56
–cve
EUVD
EUVD-2026-38560
23 Jun 202617:56
–euvd
Github Security Blog
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
18 May 202613:40
–github
NVD
CVE-2026-45135
23 Jun 202618:17
–nvd
OSV
GHSA-M675-2P33-XV9G Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
18 May 202613:40
–osv
OSV
MINI-8QH5-R8H3-45GP
19 May 202615:59
–osv
Positive Technologies
PT-2026-41687
18 May 202600:00
–ptsecurity
Rows per page
[
  {
    "vendor": "caddyserver",
    "product": "caddy",
    "versions": [
      {
        "version": ">= 2.7.0, < 2.11.3",
        "status": "affected"
      }
    ]
  }
]

Data

Build on a solid foundation withΒ Vulners data

WeΒ provide theΒ essential building blocks forΒ cybersecurity solutions withΒ comprehensive, structured, andΒ constantly updated vulnerability andΒ exploits data

Api

Power your application withΒ Vulners API

The Vulners REST API offers reliable, high-performance access toΒ vulnerabilityΒ intelligence, withΒ 99.9%Β SLAΒ uptime andΒ CDN-backed data delivery forΒ seamlessΒ global access

App

Assess and manage vulnerabilities withΒ VulnersΒ tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

23 Jun 2026 17:56Current
CVSS 3.18.1
EPSS0.00297
6