CVE-2026-27585
Fixed in a distro release EPSS <1%CVSS 6.9
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Products: caddyserver caddy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/caddyserver/caddy/v2 | 2.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | caddy | 2.6.2-5+deb12u1 |
| Debian 13 | caddy | 2.6.2-12+deb13u1 |
| Debian 14 | caddy | 2.11.2-1 |
| Ubuntu 25.10 | caddy | no fix |
| Ubuntu 26.10 | caddy | no fix |
| Ubuntu Pro 24.04 LTS | caddy | no fix |
| Ubuntu Pro 26.04 LTS | caddy | no fix |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |