Path Sanitization Bypass in Caddy Server Affecting Specific Environments

CVE-2026-27585

What is CVE-2026-27585?

Caddy, a flexible server platform that defaults to using TLS, has a vulnerability associated with its path sanitization process. Prior to version 2.11.1, the file matcher fails to properly sanitize backslashes, potentially allowing attackers to bypass certain path-related security mechanisms. This vulnerability affects specific configurations of Caddy, making it critical for users to update to version 2.11.1 or later to ensure enhanced security measures. For detailed information on the issue and updates, reference the Caddy security advisory and release notes.

References