By vendor

Caddyserver vulnerabilities

Known CVEs affecting Caddyserver products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-45135HIGH 8.1

  Caddy, a popular TLS-enabled web server platform, contains a flaw in its FastCGI request routing logic that could allow an attacker to execute arbitrary code on affected servers. The vulnerability exists when Caddy processes HTTP requests with non-ASCII characters in the path. An attacker who can upload files or control content served through FastCGI can exploit this misconfiguration to trick Caddy into treating non-script files (like images or documents) as executable scripts, leading to remote code execution. The issue affects versions 2.7.0 through 2.11.2 and is resolved in version 2.11.3.

• CVE-2026-52845HIGH 8.1

  Caddy, a modern web server platform, contains a header-handling vulnerability that allows authenticated attackers to inject fake identity or group information into requests sent to PHP applications. The issue stems from a mismatch in how Caddy processes headers during authentication checks versus how it later converts those headers for PHP/FastCGI backends. An attacker can exploit this by sending a specially crafted header variant that bypasses Caddy's security controls, potentially allowing privilege escalation or impersonation within downstream applications. The flaw affects versions before 2.11.4 and is corrected in that release.

• CVE-2026-52844HIGH 7.5

  Caddy, a popular web server platform, has a flaw in how it handles file paths on Windows systems. When a client requests a file using mixed path separators (like /private\secret.txt), Caddy's security rules incorrectly think the request is outside a protected directory, but the actual file serving code resolves it to the correct file anyway. This means an attacker can bypass authentication or access denial rules that are meant to protect sensitive files. The issue only affects Windows deployments running Caddy before version 2.11.4.

• CVE-2026-45692MEDIUM 5.4

  Caddy, a popular open-source web server known for automatic HTTPS, contains a path traversal vulnerability affecting versions 2.4.0 through 2.11.2. The vulnerability arises from a disagreement between two critical layers: the authorization system checks permissions using simple text matching, while the configuration API parses the same paths using numerical array indexing. An attacker with valid credentials can exploit this mismatch to access configuration objects they shouldn't be able to reach. For example, a user authorized to view `/config/servers/0` might be able to access `/config/servers/1` by manipulating how indices are parsed. The flaw requires authentication, so it primarily affects scenarios where multiple users or services share a Caddy instance.

• CVE-2026-52846MEDIUM 4.2

  Caddy's stripHTML template function, designed to remove HTML tags from user input, has a flaw that allows certain malformed HTML patterns to bypass its filtering logic. Specifically, malformed tags like <<>img src=x onerror=alert()> can slip through, potentially leaving executable scripts in the output if that output is later rendered as HTML in a browser. This creates a client-side XSS vulnerability when applications use stripHTML to sanitize untrusted content but then display the result unsafely. The flaw affects Caddy versions prior to 2.11.4.