Bug 2442409 (CVE-2026-27585)

Summary: CVE-2026-27585 github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver: Caddy: Path security bypass due to unsanitized backslashes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Caddy, an extensible server platform. The path sanitization routine in the file matcher component does not properly sanitize backslashes. This vulnerability can be exploited by users with specific Caddy and environment configurations, potentially leading to the bypass of path-related security protections.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2442472    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-24 17:06:12 UTC
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.