Case Sensitivity Issue in Fileserver Module of Caddy Server
CVE-2026-92700

6.3MEDIUM

Key Information:

Vendor

Caddyserver

Status
Caddy
Vendor
CVE Published:
23 September 2026

What is CVE-2026-92700?

A vulnerability exists in Caddy Server's fileserver module, where the fileHidden() function performs case-sensitive checks on file paths. This can lead to bypassing intended hide rules, particularly on case-insensitive filesystems. As a result, sensitive files that should remain hidden may unintentionally be exposed when utilizing mixed-case paths. This risk underscores the importance of proper configuration and awareness of how file handling works in various environments.

Affected Version(s)

caddy <= 2.11.3

References

https://github.com/caddyserver/caddy/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.