Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-24 | 1 | Disclosure1 |
| 2026-02-25 | 2 | Disclosure2 |
CVE-2026-27585 Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes w… https://www.cve.org/CVERecord?id=CVE-2026-27585
Post summary
The text announces CVE-2026-27585, describing a path sanitization flaw in Caddy before v2.11.1 that fails to sanitize backslashes, but provides no PoC, exploit, or patch details.
CVE-2026-27585: Backslash Blues: Bypassing Caddy's ACLs with a Single Character A semantic gap between Caddy's HTTP request matching and the underlying Go filesystem globbing logic allows attackers to bypass path-based access controls. By injecting ba... https://cvereports.com/reports/CVE-2026-27585
Post summary
The report highlights a semantic gap in Caddy that permits path-based ACL bypass via a single character injection, but it does not provide a PoC, exploit code, or patch information.
CVE-2026-27585 Path Traversal Vulnerability in Caddy Web Server Prior to Version... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27585 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces a path traversal vulnerability (CVE‑2026‑27585) affecting Caddy Web Server, with technical details and a link to further information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | caddyserver | caddy | - | - | - |