PT-2026-50160 · Caddy · Caddy
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Caddy versions prior to 2.11.4
Description
On Windows, a mismatch exists between how Caddy path matchers and the
file server handle request paths. The MatchPath.MatchWithError() function compares the r.URL.Path using URL path semantics and does not normalize backslashes (``) to forward slashes (/). Consequently, a request path such as /privatesecret.txt is treated as being outside the /private/* scope. However, the file server later resolves this same path using SanitizedPathJoin(), and since Windows treats backslashes as directory separators, the file within the protected directory is served. This allows an unauthenticated remote client to bypass path-scoped authorization or deny routes, leading to the disclosure of sensitive files within the protected subtree.Recommendations
Update to version 2.11.4.
As a temporary workaround, restrict access to the
file server module or avoid using path-scoped auth/deny routes to protect sensitive directories on Windows until the update is applied.Exploit
Fix
Path traversal
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Caddy