high CVSS 7.5 EPSS 0.62%

CVE-2026-52844·Caddy vulnerability

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

Severity
high
Software
Caddy
Fixed in
2.11.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.62% — higher than 48% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-52844 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.62%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 2.11.4

Fixed in: 2.11.4

How to fix this CVE

Upgrade Caddy to version 2.11.4 or later to resolve a critical path traversal vulnerability on Windows systems. The vulnerability allows attackers to bypass authentication controls by exploiting inconsistent path handling between the matcher and file server components. Immediately apply this update if your Caddy instance runs on Windows and uses path-scoped authorization rules.

sudo dnf update caddy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST requests containing encoded or literal backslash characters in the path (e.g., /private%5Csecret.txt or /private\secret.txt) targeting directories protected by auth/deny matchers, resulting in HTTP 200 responses instead of expected 401/403

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Configure WAF rules to block HTTP requests with backslash characters in the URI path on Windows-hosted Caddy servers: ModSecurity rule to reject requests where REQUEST_URI matches (?:\\|%5C) when path matching rules are in place

How to check if you are affected

  1. Check your Caddy version by running: caddy version
  2. Verify if your Caddyfile contains path matchers with auth/deny directives: grep -E '(basicauth|authorize|deny)' /etc/caddy/Caddyfile
  3. On Windows systems, inspect access logs for requests using backslash notation (e.g., /private\secret.txt) targeting protected paths: Get-Content C:\path\to\caddy\logs\* | Select-String '\\' | Select-String '/private'
  4. After updating to 2.11.4+, confirm the fix: caddy version | grep -E '2\.(1[1-9]|[2-9][0-9]|11\.[4-9])'
  5. Restart Caddy service: sudo systemctl restart caddy (Linux) or net stop Caddy && net start Caddy (Windows)

FAQ

What is CVE-2026-52844?

CVE-2026-52844 is a Windows-specific path traversal vulnerability in Caddy where the path matcher and file server components interpret backslash-encoded paths differently, allowing attackers to bypass authentication rules protecting directories with forward slashes.

Is CVE-2026-52844 being actively exploited?

No, this vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available.

What versions of Caddy are affected by CVE-2026-52844?

All versions of Caddy prior to and including 2.11.3 are vulnerable; the vulnerability is patched in version 2.11.4 and later.

How do I check if my server is vulnerable to CVE-2026-52844?

Run 'caddy version' and compare against version 2.11.4. If your version is 2.11.3 or earlier AND your system is Windows AND your Caddyfile contains path-scoped authentication rules, your server is vulnerable.

Does this vulnerability affect Linux systems?

No, this vulnerability is specific to Windows due to differences in path resolution between forward slashes and backslashes; Linux systems are not affected.

Does Defensia detect CVE-2026-52844?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Caddy is installed on a monitored server, CVE-2026-52844 will appear in your dashboard with remediation steps.

Related Caddy CVEs

CVE-2026-27590CVSS 9.8Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
CVE-2026-52845CVSS 8.1Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVE-2026-45135CVSS 8.1Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
CVE-2026-45692CVSS 5.4Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
CVE-2026-52846CVSS 4.2Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-52844. Free for 1 server.

Get started free