https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:55:59.717684+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273591 EUVD-2026-273591 2026-10-03T16:55:59.785237+00:00 EUVD-2026-273591 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27585 fkie_cve-2026-27585 2026-10-03T16:55:59.785275+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-4xrr-hq4w-6vf4 GHSA-4xrr-hq4w-6vf4 — Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections 2026-10-03T16:55:59.785310+00:00

Affected: Go: github.com/caddyserver/caddy/v2

### Summary

The path sanitization in [file matcher](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) doesn't sanitize backslashes which can lead to bypassing path related security protections.

### Details

The [try_files](https://caddyserver.com/docs/caddyfile/directives/try_files) directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It's commonly used in Caddy configs. For example, it's used in SPA applications to rewrite every route that doesn't exist as a file to `index.html`. ```caddy example.com { root * /srv encode try_files {path} /index.html file_server } ```

`try_files` patterns are actually glob patterns and file matcher expands them. The `{path}` in the pattern is replaced with the request path and then [is expanded by `fs.Glob`](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398). The request path is sanitized before being placed inside the pattern and the special chars are escaped . [The following code](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) is the sanitization part.

```go var globSafeRepl = strings.NewReplacer( "*", "\\*", "[", "\\[", "?", "\\?", )

expandedFile, err := repl.ReplaceFunc(file, func(variabl…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27585 UBUNTU-CVE-2026-27585 2026-10-03T16:55:59.785369+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.