{"id":"EUVD-2026-38557","enisaUuid":"41a12cf3-922d-3970-81c5-51698873137c","description":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\\secret.txt as outside /private/*, but file_server later resolves the same request path as private\\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.","datePublished":"Jun 23, 2026, 5:50:42 PM","dateUpdated":"Jun 23, 2026, 8:06:12 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6\n","aliases":"CVE-2026-52844\nGHSA-qrp7-cvwr-j2c6\n","assigner":"GitHub_M","epss":0.62,"enisaIdProduct":[{"id":"850310f0-84f4-3edd-acb5-fb34d0d42d29","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"enisaIdVendor":[{"id":"f13c72e7-518e-3892-af7a-67a71ed9ced8","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"6a650d75-1beb-3e29-a8ff-321429de0235","vulnerability":{"id":"CVE-2026-52844","description":"Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\\secret.txt as outside /private/*, but file_server later resolves the same request path as private\\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.","datePublished":"Jun 23, 2026, 5:50:42 PM","dateUpdated":"Jun 23, 2026, 8:06:12 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6\n","enisa_id":"EUVD-2026-38557\n","assigner":"GitHub_M","epss":0.62,"dataProcessed":"Nov 3, 2026, 7:16:01 AM","vulnerabilityProduct":[{"id":"edbbf96a-59a6-31ac-9594-2a158beed104","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"vulnerabilityVendor":[{"id":"6db33ef7-8d37-32b3-8f11-eff06610fa7a","vendor":{"name":"caddyserver"}}]}},{"id":"b3a90eb2-4699-3d67-b3da-a1e9d486b75a","vulnerability":{"id":"GHSA-qrp7-cvwr-j2c6","description":"Caddy: Windows `file_server` path authorization bypass via encoded backslash","datePublished":"Jun 16, 2026, 9:28:11 PM","dateUpdated":"Jul 20, 2026, 9:02:09 PM","baseScore":0.0,"references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52844\nhttps://github.com/caddyserver/caddy\n","enisa_id":"EUVD-2026-38557\n","aliases":"GHSA-qrp7-cvwr-j2c6\nCVE-2026-52844\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}