CVE-2026-52844

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6	Third Party Advisory Exploit
https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6	Third Party Advisory Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Caddy es una plataforma de servidor extensible que usa TLS por defecto. Antes de la versión 2.11.4, en Windows, los emparejadores de rutas de Caddy tratan /private\secret.txt como fuera de /private/, pero file_server luego resuelve la misma ruta de solicitud como private\secret.txt en el disco. Un cliente remoto no autenticado puede eludir las rutas de auth/deny con ámbito de ruta de Caddy que protegen /private/. Esta vulnerabilidad se corrige en la versión 2.11.4.

Information

Published : 2026-06-23 18:18

Updated : 2026-10-25 23:10

NVD link : CVE-2026-52844

Mitre link : CVE-2026-52844

CVE.ORG link : CVE-2026-52844

JSON object : View

Products Affected

microsoft

windows

caddyserver

caddy

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-284

Improper Access Control

{"id": "CVE-2026-52844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52844", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T20:05:58.401415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"status": "affected", "version": "< 2.11.4"}]}]}], "published": "2026-06-23T18:18:05.137", "references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6", "tags": ["Third Party Advisory", "Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6", "tags": ["Third Party Advisory", "Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\\secret.txt as outside /private/*, but file_server later resolves the same request path as private\\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4."}, {"lang": "es", "value": "Caddy es una plataforma de servidor extensible que usa TLS por defecto. Antes de la versi\u00f3n 2.11.4, en Windows, los emparejadores de rutas de Caddy tratan /private\\secret.txt como fuera de /private/*, pero file_server luego resuelve la misma ruta de solicitud como private\\secret.txt en el disco. Un cliente remoto no autenticado puede eludir las rutas de auth/deny con \u00e1mbito de ruta de Caddy que protegen /private/*. Esta vulnerabilidad se corrige en la versi\u00f3n 2.11.4."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CC2FFA3-3F35-452A-A0B6-C1B66C0C73E6", "versionEndExcluding": "2.11.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-advisories@github.com"}