CVE-2026-27585
Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
| CWE | CWE-20 |
| Vendor | caddyserver |
| Product | caddy |
| Published | Feb 24, 2026 |
| Last Updated | Feb 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for caddyserver caddy
Be the first to know when new unknown vulnerabilities affecting caddyserver caddy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
caddyserver / caddy
< 2.11.1
References
github.com: https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4 github.com: https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361 github.com: https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398 github.com: https://github.com/caddyserver/caddy/releases/tag/v2.11.1