https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:50:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-273591 EUVD-2026-273591 https://cve.radiocsirt.org/vuln/euvd-2026-273591 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27585 <p>Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.</p> <p>Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27585 https://cve.radiocsirt.org/vuln/ghsa-4xrr-hq4w-6vf4 <p><strong>Affected:</strong> Go: github.com/caddyserver/caddy/v2</p> <p>### Summary</p> <p>The path sanitization in [file matcher](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections.</p> <p>### Details</p> <p>The [try_files](https://caddyserver.com/docs/caddyfile/directives/try_files) directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It&#39;s commonly used in Caddy configs. For example, it&#39;s used in SPA applications to rewrite every route that doesn&#39;t exist as a file to `index.html`. ```caddy example.com { root * /srv encode try_files {path} /index.html file_server } ```</p> <p>`try_files` patterns are actually glob patterns and file matcher expands them. The `{path}` in the pattern is replaced with the request path and then [is expanded by `fs.Glob`](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398). The request path is sanitized before being placed inside the pattern and the special chars are escaped . [The following code](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) is the sanitization part.</p> <p>```go var globSafeRepl = strings.NewReplacer( &#34;*&#34;, &#34;\\*&#34;, &#34;[&#34;, &#34;\\[&#34;, &#34;?&#34;, &#34;\\?&#34;, )</p> <p>expandedFile, err := repl.ReplaceFunc(file, func(variabl…</p> <p><strong>Affected:</strong> Go: github.com/caddyserver/caddy/v2</p> <p>### Summary</p> <p>The path sanitization in [file matcher](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections.</p> <p>### Details</p> <p>The [try_files](https://caddyserver.com/docs/caddyfile/directives/try_files) directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It&#39;s commonly used in Caddy configs. For example, it&#39;s used in SPA applications to rewrite every route that doesn&#39;t exist as a file to `index.html`. ```caddy example.com { root * /srv encode try_files {path} /index.html file_server } ```</p> <p>`try_files` patterns are actually glob patterns and file matcher expands them. The `{path}` in the pattern is replaced with the request path and then [is expanded by `fs.Glob`](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398). The request path is sanitized before being placed inside the pattern and the special chars are escaped . [The following code](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) is the sanitization part.</p> <p>```go var globSafeRepl = strings.NewReplacer( &#34;*&#34;, &#34;\\*&#34;, &#34;[&#34;, &#34;\\[&#34;, &#34;?&#34;, &#34;\\?&#34;, )</p> <p>expandedFile, err := repl.ReplaceFunc(file, func(variabl…</p> https://cve.radiocsirt.org/vuln/ghsa-4xrr-hq4w-6vf4 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27585 <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy</p> <p>Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:25.10: caddy, Ubuntu:Pro:26.04:LTS: caddy</p> <p>Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27585