CVE-2026-45692

The record

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Affected packages

Related vulnerabilities

• CVE-2026-84376 Astro is a web framework for content-driven websites. CWE-187
• CVE-2026-62750 Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker… CWE-187
• CVE-2026-14687 A vulnerability was determined in 666ghj BettaFish up to 1.2.1. CWE-187
• CVE-2026-55602 http-proxy-middleware is node.js http-proxy middleware. CWE-187
• GHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven… CWE-187
• CVE-2026-44837 view_component is a framework for building reusable, testable, and encapsulated view… CWE-187
• CVE-2026-35031 Jellyfin is an open source self hosted media server. CWE-187
• CVE-2026-34785 Rack is a modular Ruby web server interface. CWE-187