Описание
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/. This vulnerability is fixed in 2.11.4.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | needs-triage | |
| jammy | DNE | |
| noble | needs-triage | |
| questing | ignored | end of life, was needs-triage |
| resolute | needs-triage | |
| stonking | needs-triage | |
| upstream | needs-triage |
Показывать по
Ссылки на источники
EPSS
7.5 High
CVSS3
Связанные уязвимости
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Caddy is an extensible server platform that uses TLS by default. Prior ...
Caddy: Windows `file_server` path authorization bypass via encoded backslash
ALT-PU-2026-10375: package `caddy` update to version 2.11.4-alt1
EPSS
7.5 High
CVSS3