Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
| Date | Total | Labels |
|---|
| 2026-06-24 | 1 | Patch1 |
| 2026-08-16 | 1 | Disclosure1 |
Caddy: Access forbidden files via `\` path confusion on Windows https://nvd.nist.gov/vuln/detail/CVE-2026-52844
Post summary
A brief disclosure of a Windows path‑confusion bug in Caddy that permits access to forbidden files; no PoC, exploit, or mitigation details are presented.
#CVE-2026-52844 - Path Traversal in #Caddy on #Windows. CVSS 7.5. Unauthenticated remote attackers can bypass auth/deny routes protecting /private/*. Fixed in 2.11.4. Update immediately. #CVEAlert #CyberSecurity #infosec #devsecops #devops #sysadmin #docker More detailed info: https://www.valtersit.com/cve/CVE-2026-52844
Post summary
CVE-2026-52844 is a path traversal vulnerability in Caddy on Windows with CVSS 7.5; it is fixed in version 2.11.4 and users should update immediately.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | caddyserver | caddy | - | - | - |
| OS | microsoft | windows | - | - | - |