Caddy: Windows `file_server` path authorization bypass via encoded backslash
Priority HIGH 72CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22, CWE-284 and the CVSS impact.
Summary
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00619 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed caddy (caddyserver): 2.11.4github.com/caddyserver/caddy/v2 (Go): 2.11.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| caddyserver | caddy | before 2.11.4 | 2.11.4 | Patch available | CNA |
| — | github.com/caddyserver/caddy/v2 (Go) | before 2.11.4 | 2.11.4 | Patch available | GHSA-qrp7-cvwr-j2c6 |
| — | github.com/caddyserver/caddy (Go) | up to 1.0.5 | — | No fix listed | GHSA-qrp7-cvwr-j2c6 |
- caddy Vendorcaddyserver Affected before 2.11.4 Fixed in 2.11.4 Patch available CNA
- github.com/caddyserver/caddy/v2 (Go) Vendor— Affected before 2.11.4 Fixed in 2.11.4 Patch available GHSA-qrp7-cvwr-j2c6
- github.com/caddyserver/caddy (Go) Vendor— Affected up to 1.0.5 Fixed in — No fix listed GHSA-qrp7-cvwr-j2c6
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* | before 2.11.4 | Vulnerable | caddyserver |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:* Versions before 2.11.4 Vulnerable ·caddyserver
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA caddy (caddyserver) Fixed in 2.11.4
- Fix · GHSA-qrp7-cvwr-j2c6 github.com/caddyserver/caddy/v2 (Go) Fixed in 2.11.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-52844
- 2026-10-03 Alias added: GHSA-qrp7-cvwr-j2c6
References
More caddyserver Caddy vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-21978 Improper input validation in caddyserver caddy CVSS 4.0HIGH 8.9
- TI-2026-21974 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVSS 4.0HIGH 8.8
- TI-2026-23680 Improper authentication in caddyserver caddy CVSS 3.1HIGH 8.8
- TI-2026-21976 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVSS 4.0HIGH 7.7
- TI-2026-21975 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVSS 4.0HIGH 7.7
Sources
- CVE-2026-52844 · CVE Program
- CVE-2026-52844 · NVD
- FIRST EPSS
- GHSA-qrp7-cvwr-j2c6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences