https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:59:01.620148+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-qe63753 CLEANSTART-2026-QE63753 — Caddy is an extensible server platform that uses TLS by default 2026-10-03T12:59:01.672105+00:00

Affected: CleanStart: caddy

Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default.

 https://cve.radiocsirt.org/vuln/euvd-2026-329703 EUVD-2026-329703 2026-10-03T12:59:01.672157+00:00 EUVD-2026-329703 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52844 fkie_cve-2026-52844 2026-10-03T12:59:01.672174+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

 https://cve.radiocsirt.org/vuln/ghsa-qrp7-cvwr-j2c6 GHSA-qrp7-cvwr-j2c6 — Caddy: Windows `file_server` path authorization bypass via encoded backslash 2026-10-03T12:59:01.672199+00:00

Affected: Go: github.com/caddyserver/caddy/v2, Go: github.com/caddyserver/caddy

### Summary

On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` later resolves the same request path as `private\secret.txt` on disk.

An unauthenticated remote client can request `/private%5csecret.txt` and bypass Caddy path-scoped auth/deny routes protecting `/private/*`.

### Details

The mismatch is between two Caddy code paths:

- `MatchPath.MatchWithError()` compares `r.URL.Path` using URL path semantics and does not normalize `\` to `/`: `modules/caddyhttp/matchers.go:429`, `:436`, `:490`, `:532`. - If the route matcher misses, Caddy skips that route: `modules/caddyhttp/routes.go:271`. - `file_server` then maps the same request path to a filesystem path with `SanitizedPathJoin(root, r.URL.Path)`: `modules/caddyhttp/fileserver/staticfiles.go:294`, `modules/caddyhttp/caddyhttp.go:257`, `:263`. - On Windows, Go filesystem path handling treats `\` as a separator, so the default filesystem opens the file under the protected directory: `internal/filesystems/os.go:18`.

This is related to, but distinct from, `GHSA-4xrr-hq4w-6vf4 / CVE-2026-27585`. That advisory fixed backslash handling in the `file` matcher / `try_files` glob path. This report does not use `try_files` or the `file` matcher; it affects ordinary `path` route matchers in front of direct `file_server` serving and reproduces on current HEAD.

### PoC

Tested on current HEAD `6c675e29f87cbe7326983ddb6d739175119d394c` with a Windows `caddy.exe` built from this r…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52844 UBUNTU-CVE-2026-52844 2026-10-03T12:59:01.672251+00:00

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.