Description
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
Remediation
References
Related Vulnerabilities
WordPress Plugin Olevmedia Shortcodes Cross-Site Scripting (1.1.8)
Jetty Uncontrolled Resource Consumption Vulnerability (CVE-2025-5115)
WordPress Plugin Invoicing with InvoiceXpress for WooCommerce-Free Cross-Site Scripting (3.0.2)
WordPress Plugin WP Open Social Cross-Site Scripting (5.0)
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-28696)