# CVE-2026-45135

## Summary

- **CVE ID:** CVE-2026-45135
- **Severity:** HIGH
- **CVSS Score:** 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-20, CWE-176, CWE-178
- **Published:** Jun 23, 2026
- **Last Modified:** Jun 23, 2026

## Description

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

## Affected Products

- caddyserver — caddy (>= 2.7.0, < 2.11.3)

## References

- [CNA](https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.68%
- **EPSS Percentile:** 50.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._