CVE-2026-27585 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backsla…
Medium CVSS: 6.9

CVE-2026-27585

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Vendor
Caddyserver
Product
Caddy
CWE
CWE-20
Yayın Tarihi
2026-02-24 17:29:03
Güncelleme
2026-02-25 17:13:16
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-20 Caddy MEDIUM Caddyserver 2026

Referanslar

https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361 https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398 https://github.com/caddyserver/caddy/releases/tag/v2.11.1 https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4