CVE-2026-52844: Caddy Windows Path Bypass Vulnerability – HIGH Severity Information Disclosure

Technical summary

CVE-2026-52844 stems from a path normalization inconsistency on Windows in Caddy versions prior to 2.11.4. The path matcher module interprets /private\secret.txt as a request outside the /private/* scope (treating the backslash as a literal character), while the file_server handler later normalizes the same path and resolves it to private\secret.txt on the Windows filesystem. This discrepancy allows unauthenticated clients to craft requests that pass through path-scoped authorization and denial rules yet still retrieve restricted files. The vulnerability is rooted in inadequate cross-component path normalization and affects the confidentiality of protected resources.

Business impact

Organizations running Caddy on Windows servers with path-based access controls are at immediate risk of unauthorized information disclosure. Any sensitive files protected by routes like /private/* become accessible to unauthenticated remote attackers without leaving audit evidence that rules were bypassed. This is particularly dangerous for systems handling customer data, internal documentation, credentials, or configuration files behind Caddy's auth middleware. Depending on the scope of protected directories, a breach could compromise compliance posture (PCI-DSS, HIPAA, GDPR) and enable secondary attacks via exposed credentials or system information.

Affected systems

Windows systems running Caddy versions 2.0 through 2.11.3 are vulnerable. This affects both standalone Caddy deployments and instances where Caddy is embedded as a platform component. Linux and macOS systems are not impacted due to their native path handling using forward slashes only. The vulnerability requires no special configuration—any Caddy instance using path matchers for authentication or denial rules on Windows is at risk by default.

Exploitability

Exploitability is very high. No authentication is required, no user interaction is needed, and the attack surface is simple: an unauthenticated remote client sends a single HTTP request crafted with mixed path separators. The attacker needs only to know or guess a protected file path; Caddy's verbose 404 responses can aid reconnaissance. Network access is the only requirement—there are no prerequisites around system state or configuration complexity.

Remediation

Upgrade to Caddy 2.11.4 or later immediately. This version implements consistent path normalization across the matcher and file_server components. Organizations should apply the update to all Windows-based Caddy deployments, including development and staging environments where developers might have access to sensitive test data. Verify the patch is in effect by checking the version string in Caddy's output and reviewing Caddyfile configurations to ensure path matchers remain in use for sensitive routes.

Patch guidance

1. Verify your current Caddy version by running `caddy version` or checking the admin API endpoint. 2. Download Caddy 2.11.4 or later from the official repository. 3. On Windows, replace the existing caddy.exe binary with the patched version. 4. Restart the Caddy service or daemon. 5. Validate that path-protected routes still function correctly and that audit logs show no suspicious path-crafting attempts during patching. 6. If running Caddy as a Docker container, ensure your image is rebuilt from an updated base that includes Caddy 2.11.4 or later. No configuration changes are required—the fix is transparent.

Detection guidance

Log analysis: Search HTTP access logs for requests containing mixed-case path separators (forward slash followed by backslash) targeting directories you protect with path matchers, such as /admin\, /private\, /api\. Indicators include 200 or 304 responses where the Caddyfile would normally return 401/403. Web application firewall (WAF) rules can flag requests with backslashes in the path component of the URL. Caddy's debug logs (with `log` directive at DEBUG level) will show path matcher decisions; review for mismatches between matcher rejection and file_server serving. Monitor for anomalous access patterns to known sensitive file locations. Before patching, review logs for the last 30–90 days to assess if exploitation has occurred.

Why prioritize this

High CVSS score (7.5) reflects the ease of exploitation, lack of authentication requirement, and direct impact to information confidentiality. The vulnerability is critical for Windows-based Caddy deployments because it defeats the point of using Caddy's path-scoped security model. Unlike memory corruption bugs that require precise conditions, this path-normalization flaw is reliable and reproducible. Any organization with sensitive files behind Caddy path rules should treat this as urgent.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is assigned because: Attack Vector is Network (AV:N), meaning remote access from the internet is possible. Attack Complexity is Low (AC:L), as no special conditions are needed—standard HTTP requests suffice. Privileges Required is None (PR:N), as the attacker is unauthenticated. User Interaction is None (UI:N), as no victim action is required. The scope is Unchanged (S:U). The impact is Confidentiality High (C:H), because sensitive files become readable; Integrity and Availability are None (I:N, A:N). The vector reflects a straightforward information disclosure vulnerability with a wide attack surface.

Frequently asked questions