PT-2026-21767 · Caddy · Caddy

Parrot409 · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27585

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1

Description The path sanitization routine in Caddy's file matcher does not properly sanitize backslashes, potentially allowing bypass of path-related security protections. This issue affects users with specific Caddy and environment configurations. The vulnerability can be exploited by crafting requests with backslashes in the path, which can bypass reverse proxy protections or other path-based security measures. The try files directive is involved in this issue, and configurations combining blacklisting and serving may be vulnerable if the try files directive and filtering route/handle directives are in the same block. A proof-of-concept demonstrates bypassing an Nginx protection by using a URL-encoded backslash in the path.

Recommendations Update Caddy to version 2.11.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-27585

GHSA-4XRR-HQ4W-6VF4

GO-2026-4535

SUSE-SU-2026:0757-1

Affected Products

Caddy

References · 127

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27585.json · Exploit
• https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4535 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27585 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27585 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27585 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27585 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xrr-hq4w-6vf4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27585 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27585 · Security Note
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398 · Note
• https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361 · Note