Description

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

Remediation

References

CVE-2026-27585

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-27279)

PHP Integer Overflow or Wraparound Vulnerability (CVE-2016-7133)

Seo Panel Server-Side Request Forgery (SSRF) Vulnerability (CVE-2024-22648)

WordPress Plugin Nextend Facebook Connect Cross-Site Scripting (1.5.5)

WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Scripting (2.0.9)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2026-27585