Vincent550102

**Name of the Vulnerable Software and Affected Versions** Caddy versions prior to 2.11.4 **Description** On Windows, a mismatch exists between how Caddy path matchers and the `file server` handle request paths. The `MatchPath.MatchWithError()` function compares the `r.URL.Path` using URL path semantics and does not normalize backslashes (``) to forward slashes (`/`). Consequently, a request path such as `/privatesecret.txt` is treated as being outside the `/private/*` scope. However, the `file server` later resolves this same path using `SanitizedPathJoin()`, and since Windows treats backslashes as directory separators, the file within the protected directory is served. This allows an unauthenticated remote client to bypass path-scoped authorization or deny routes, leading to the disclosure of sensitive files within the protected subtree. **Recommendations** Update to version 2.11.4. As a temporary workaround, restrict access to the `file server` module or avoid using path-scoped auth/deny routes to protect sensitive directories on Windows until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Caddy versions prior to 2.11.4 **Description** An issue exists where `forward auth copy headers` deletes client-supplied identity headers before copying trusted values from an authentication gateway. However, when requests are processed via `php fastcgi`, Caddy normalizes HTTP headers into CGI variables by replacing hyphens (`-`) with underscores (` `). This allows a remote client to send an underscore alias (e.g., `Remote Groups` instead of `Remote-Groups`) that bypasses the deletion step but results in the same PHP/FastCGI variable (e.g., `HTTP REMOTE GROUPS`). Consequently, a remote client can inject or override identity or group headers trusted by PHP/FastCGI applications behind Caddy, potentially leading to group/role injection or user impersonation. **Recommendations** Update to version 2.11.4. As a temporary workaround, restrict the use of the `php fastcgi` module or the `forward auth` `copy headers` feature for identity headers until the update is applied.