—
GO-2026-5492
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy
Quick fix
GO-2026-5492 — github.com/caddyserver/caddy/v2: upgrade to the fixed version with the command below.
go get github.com/caddyserver/caddy/v2@v2.11.3Details
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/caddyserver/caddy/v2
Introduced in:
2.7.0 Fixed in: 2.11.3 Fix
go get github.com/caddyserver/caddy/v2@v2.11.3 References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g [ADVISORY]
- https://github.com/caddyserver/caddy/pull/7629 [FIX]
- https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm [WEB]
- https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 [WEB]