Medium severity · published Feb 24, 2026
CVE-2026-27585
Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
caddy · caddyserver
< 2.11.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27585
Product
https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361
Product
https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398
Release Notes
https://github.com/caddyserver/caddy/releases/tag/v2.11.1
Exploit
https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4
More from caddy
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2026-27590
Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
9.8
CVE-2018-21246
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode
9.1
CVE-2026-27588
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
9.1
CVE-2026-27587
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass