CVE-2026-92700
Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.
| CWE | CWE-178 |
| Vendor | caddyserver |
| Product | caddy |
| Published | Sep 23, 2026 |
| Last Updated | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for caddyserver caddy
Be the first to know when new unknown vulnerabilities affecting caddyserver caddy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
caddyserver / caddy
<= 2.11.3