Caddy: Windows `file_server` path authorization bypass via encoded backslash

Also known as GHSA-qrp7-cvwr-j2c6, GO-2026-5595

Published 4 mo ago 2026-06-16 · modified 12 d ago 2026-10-25 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 50%

Public exploits

none known

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago 2026-06-23

Exploit prediction (EPSS)

0.62% probability of exploitation in the next 30 days, higher than 50% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/caddyserver/caddy/v2`	<2.11.4	2.11.4
go	`github.com/caddyserver/caddy`	<=1.0.5	no fix listed

Affected products

caddyserver caddy

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-284 Improper Access Control

References

github.com /caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6 · x_refsource_CONFIRM, exploit
nvd.nist.gov /vuln/detail/CVE-2026-52844 · advisory
github.com /caddyserver/caddy · package

Sources

CVE List: CVE-2026-52844
GitHub Advisory: GHSA-qrp7-cvwr-j2c6
NVD: CVE-2026-52844
OSV: GO-2026-5595

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary