Caddy's FastCGI path splitting logic incorrectly uses the index from a lowercased copy of the request path to slice the original path. Because Unicode casefolding can change UTF‑8 byte length, the derived SCRIPT_NAME/PATH_INFO values can be wrong, leading the server to execute an unintended on‑disk file. In setups where attackers can supply file contents, this flaw may allow PHP code execution of non‑.php files, potentially giving remote code execution capabilities where PHP is configured.

The flaw exists in the open‑source Caddy HTTP/HTTPS server from caddyserver. All versions of Caddy server released before 2.11.1 are affected. The issue only manifests when the FastCGI transport is used, such as when Caddy proxies requests to a PHP interpreter and the server or an upload facility allows an attacker to control the requested path.

The CVSS score of 8.9 categorizes this vulnerability as high severity, but the EPSS score of less than 1% indicates that exploitation attempts are currently rare. The flaw is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP request containing a Unicode path that, when lowercased, changes byte length, and rely on the FastCGI configuration to execute the wrong script. The presence of file upload or dynamic paths increases the likelihood of successful exploitation; otherwise, the risk remains limited to environments that use FastCGI for PHP.