SB20261109222 - Multiple vulnerabilities in Caddy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109222

SB20261109222 - Multiple vulnerabilities in Caddy

Published: November 9, 2026 Updated: November 12, 2026

Security Bulletin ID SB20261109222
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 25% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Handling of Unicode Encoding (CVE-ID: CVE-2026-45135)

CWE-ID: CWE-176 - Improper Handling of Unicode Encoding

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code in a FastCGI upstream through non-PHP files.

The vulnerability exists due to unsafe Unicode handling in Caddy's FastCGI path splitting when non-ASCII request paths are matched against configured script extensions. An unauthenticated remote attacker can place executable content in a served file with a specially crafted non-ASCII filename and request a crafted URL to have that file treated as a script.


2) Partial String Comparison (CVE-ID: CVE-2026-45692)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote administrator with restricted permissions to read and modify configuration objects outside their authorized scope.

The vulnerability exists due to inconsistent path interpretation in Caddy's /config API, where authorization uses textual prefixes but traversal interprets leading-zero array indices numerically. A remote administrator with restricted permissions can use a delegated client certificate on a configured remote admin endpoint to request a leading-zero index and access another array element using otherwise permitted read or write methods.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass configured PKI access restrictions and read information about unauthorized certificate authorities.

The vulnerability exists due to prefix-based path authorization without path-segment boundary checks in Caddy's PKI admin endpoints when remote administration is enabled. A low-privileged remote attacker can use a client certificate restricted to /pki/ca/prod to request /pki/ca/prod-backup and retrieve that authority's information.


4) Improper Neutralization of Special Elements used in an Expression Language Statement (CVE-ID: N/A)

CWE-ID: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose environment variables, system information, and file contents up to 1 MB.

The vulnerability exists due to expression language injection in Caddy's variable matchers when header-derived values stored under literal variable keys undergo a second placeholder expansion. A remote attacker can send headers containing {env.AWS_SECRET_ACCESS_KEY} or {file./etc/passwd} to expose expanded secrets through configured response headers or forwarding to a backend.


Remediation

Install update from vendor's website.

References