Поиск уязвимостей

БДУ ФСТЭК

Microsoft MSRC

NVD

Oracle ELSA

Red Hat CVE

РЕД ОС

Rocky RLSA

SUSE CVRF

Ubuntu

Debian

Github

ALT Linux

Количество 5

CVE-2026-52844

5 месяцев назад

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

CVSS3: 7.5

EPSS: Низкий

CVE-2026-52844

5 месяцев назад

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

CVSS3: 7.5

EPSS: Низкий

CVE-2026-52844

5 месяцев назад

Caddy is an extensible server platform that uses TLS by default. Prior ...

CVSS3: 7.5

EPSS: Низкий

GHSA-qrp7-cvwr-j2c6

5 месяцев назад

Caddy: Windows `file_server` path authorization bypass via encoded backslash

CVSS3: 7.5

EPSS: Низкий

ALT-PU-2026-10375

4 месяца назад

ALT-PU-2026-10375: package `caddy` update to version 2.11.4-alt1

CVSS3: 8.1

EPSS: Низкий

Уязвимостей на страницу

Уязвимость	CVSS	EPSS	Опубликовано
CVE-2026-52844 Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/. This vulnerability is fixed in 2.11.4.	CVSS3: 7.5	1% Низкий	5 месяцев назад
CVE-2026-52844 Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/. This vulnerability is fixed in 2.11.4.	CVSS3: 7.5	1% Низкий	5 месяцев назад
CVE-2026-52844 Caddy is an extensible server platform that uses TLS by default. Prior ...	CVSS3: 7.5	1% Низкий	5 месяцев назад
GHSA-qrp7-cvwr-j2c6 Caddy: Windows `file_server` path authorization bypass via encoded backslash	CVSS3: 7.5	1% Низкий	5 месяцев назад
ALT-PU-2026-10375 ALT-PU-2026-10375: package `caddy` update to version 2.11.4-alt1	CVSS3: 8.1		4 месяца назад

Уязвимостей на страницу