CVE-2026-27590 is a vulnerability in the Caddy web server platform, specifically in its FastCGI path splitting logic prior to version 2.11.1. Caddy processes FastCGI requests by splitting the request path to determine SCRIPT_NAME, SCRIPT_FILENAME, and PATH_INFO. The flaw stems from computing the split index on a lowercased copy of the request path using strings.ToLower(), which can change the byte length of UTF-8 characters. Because the index is then applied to the original path, this mismatch can cause incorrect slicing, resulting in path confusion. An attacker can craft requests containing '.php' that cause the server to execute a different file than intended. In environments where attackers can upload or control file contents, this can lead to execution of arbitrary code, effectively remote code execution (RCE). The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 score is 8.9 (high), reflecting the ease of exploitation and severe impact on confidentiality, integrity, and availability. The issue is resolved in Caddy version 2.11.1 by correcting the path splitting logic to avoid relying on lowercased byte indices.

The vulnerability allows attackers to bypass intended path restrictions and execute arbitrary files as PHP scripts, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of affected systems. Organizations running vulnerable Caddy versions with FastCGI and PHP setups are at risk of unauthorized access, data breaches, and full system compromise. The impact is especially severe in environments that allow file uploads or content control by untrusted users, as attackers can upload malicious payloads disguised as non-PHP files but executed as PHP. Exploitation requires no authentication or user interaction, increasing the risk of widespread attacks. This can lead to service disruption, data loss, and lateral movement within networks.

1. Upgrade all Caddy server instances to version 2.11.1 or later immediately to apply the fix for this vulnerability. 2. Review and restrict file upload mechanisms to ensure only safe file types are accepted and stored securely, preventing attackers from uploading malicious files. 3. Implement strict input validation and sanitization on all user-supplied data, especially file paths and names. 4. Use web application firewalls (WAFs) to detect and block suspicious FastCGI requests that attempt path manipulation or unusual '.php' execution patterns. 5. Monitor server logs for anomalous requests containing crafted paths or unexpected file executions. 6. Employ least privilege principles for web server and PHP process permissions to limit the impact of any successful exploitation. 7. Conduct regular security audits and penetration testing focusing on FastCGI and file upload components. 8. Consider disabling FastCGI or PHP execution where not required to reduce attack surface.