CVE-2026-27585
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Feb 24, 2026
CISA due date
—
The record
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/caddyserver/caddy/v2 | 0 | 2.11.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4535 Improper sanitization of glob characters in github.com/caddyserver/caddy/v2 Same vulnerability
- GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4536 Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4537 Caddy is vulnerable to cross-origin config application via local admin API /load in… Also affects github.com/caddyserver/caddy/v2
- GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- GO-2026-4538 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2 Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27589 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2
- CVE-2026-27588 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/caddyserver/caddy/v2