CVE-2026-52844 Caddy: Windows `file_server` path authorization bypass via encoded backslash
HighCVSS 7.5
EPSS 0.62%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/. This vulnerability is fixed in 2.11.4.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| caddyserver github.com/caddyserver/caddy | = < 2.11.4 | No fix listed |
| caddyserver github.com/caddyserver/caddy(Go) | < 2.11.4 | 2.11.4 |
| caddyserver github.com/caddyserver/caddy(Go) | <= 1.0.5 | No fix listed |
| debian/caddy(Debian:14) | < 2.11.4-1 | 2.11.4-1 |
| debian/caddy(Debian:14) | = 2.11.2-1 | No fix listed |
| debian/caddy(Debian:14) | = 2.11.2-1~bpo13+1 | No fix listed |
| debian/caddy(Debian:14) | = 2.6.2-12 | No fix listed |
| debian/caddy(Debian:14) | = 2.6.2-13 | No fix listed |
| debian/caddy(Debian:14) | = 2.6.2-14 | No fix listed |
| ubuntu/caddy(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/caddy(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/caddy(Ubuntu:26.10) | All versions | No fix listed |
| caddyserver github.com/caddyserver/caddy | < 2.11.4 | 2.11.4 |
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6 exploit third-party-advisory vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- Debian Security Tracker CVE-2026-52844 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org