CVE-2026-52844— Caddy: Windows `file_server` path authorization bypass via encoded backslash
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-52844
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Caddy: Windows `file_server` path authorization bypass via encoded backslash
Source: NVD (National Vulnerability Database)
Vulnerability Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| caddyserver | caddy | < 2.11.4 | - |
II. Public POCs for CVE-2026-52844
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-52844
请登录查看更多情报信息。
Other References for CVE-2026-52844 (1)
Same Patch Batch · caddyserver · 2026-06-23 · 5 CVEs total
| CVE-2026-45135 | 8.1 HIGH | Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files |
| CVE-2026-52845 | 8.1 HIGH | Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` |
| CVE-2026-45692 | 5.4 MEDIUM | Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization |
| CVE-2026-52846 | 4.2 MEDIUM | Caddy: stripHTML template function bypass |
IV. Related Vulnerabilities
Same product: caddy
- CVE-2026-45135
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Ex - CVE-2026-45692
Caddy: Remote Admin Authorization Bypass in `/config` API vi - CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth - CVE-2026-52846
Caddy: stripHTML template function bypass - CVE-2026-30851
Caddy forward_auth copy_headers Does Not Strip Client-Suppli
Same vendor: caddyserver
- CVE-2026-45135
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Ex - CVE-2026-45692
Caddy: Remote Admin Authorization Bypass in `/config` API vi - CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth - CVE-2026-52846
Caddy: stripHTML template function bypass - CVE-2026-30851
Caddy forward_auth copy_headers Does Not Strip Client-Suppli
Same weakness: CWE-22
- CVE-2026-54557
mise HTTP backend uses raw version path for install symlink - CVE-2026-56876
extract-zip unvalidated symlink path traversal - CVE-2026-55677
Echo: Encoded slash (%2F) bypasses route-level protection an - CVE-2026-57321
WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vul - CVE-2026-56066
WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbi
V. Comments for CVE-2026-52844
No comments yet