ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-45135

Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Published May 13, 2026 · catalog updated May 13, 2026 · Unsafe Unicode Handling in

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-45135. EPSS is 0.68%. Act only if a listed version of Unsafe Unicode Handling in is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Unsafe Unicode Handling in).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.68%
Remediation
Version ranges on file
Affected products
go github.com/caddyserver/caddy/v2

### Summary The FastCGI transport's in [ ](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go) misuses with when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non- (or other configured extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This function was adapted from FrankenPHP's code (see [the source comment](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go#L429)) and inherits the same bugs. Both were originally reported against FrankenPHP by @KC1zs4 as [GHSA-3g8v-8r37-cgjm](https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm) (which absorbed the duplicate GHSA-v4h7-cj44-8fc8). Credit for finding the underlying flaws belongs to @KC1zs4. ### Details #### Flaw 1 — Control-flow: stale after inner non-ASCII fallback In the inner loop, when a byte satisfies and returns , the loop s without setting . The outer code then evaluates with still , returning a position as if the configured extension had been matched. The script-name suffix actually present at that offset is whatever bytes the attacker chose, so a file named gets routed as PHP. #### Flaw 2 — Unicode equivalence: folds non-ASCII lookalikes onto ASCII performs Unicode equivalence matching (compatibility decomposition + case folding), which goes far beyond the ASCII-only case folding the surrounding code is built for. Many code points fold onto ASCII , , , , so a path containing , , , , , , , etc. is reported as . Both flaws share the same root cause: invoking to match an ASCII-only, validated-lower-case entry against an arbitrary path. already guarantees every entry is ASCII and lower-cased, so any byte in th

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go github.com/caddyserver/caddy/v2>= 2.7.0, <= 2.10.2

How to fix CVE-2026-45135

  • Upgrade

    CVE-2026-45135 lists a fix boundary at 2.10.2. Compare the installed build with that boundary before you change production.

  • Version check

    Affected <= 2.10.2

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-45135. EPSS is 0.68%. Act only if a listed version of Unsafe Unicode Handling in is installed.

Which versions are affected?

Compare what you have installed with >= 2.7.0, <= 2.10.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-176; CWE-178; CWE-20: Improper Input Validation. EPSS 0.68%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Caddy security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · Maintainer security tabs

    Detected

    ### Summary The FastCGI transport's in [ ](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go) misuses with when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non- (or other configured extension) file as a script. In any deployment where the attacker c

  2. May 13, 2026 · Maintainer security tabs

    Updated

    ### Summary The FastCGI transport's in [ ](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go) misuses with when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non- (or other configured extension) file as a script. In any deployment where the attacker c

Sources

  • Maintainer security tabsVendor advisoryGHSA-m675-2p33-xv9g

    ### Summary The FastCGI transport's in [ ](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go) misuses with when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non- (or other configured extension) file as a script. In any deployment where the attacker c

    github.com

Freshness

Last verified in this catalog Nov 1, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 1, 2026