CVE-2026-27585: Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-20

Description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

Affected products

caddyserver caddy: before 2.11.1 — fixed in 2.11.1

How to fix

Upgrade to a fixed version: caddyserver caddy 2.11.1. Check the vendor advisory for mitigations.

References

https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361
https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398
https://github.com/caddyserver/caddy/releases/tag/v2.11.1
https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4

Get alerted when CVE-2026-27585 or the next vulnerability affects your stack