-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/caddyserver/caddy | go | < 2.5.0 | 2.5.0 |
| github.com/caddyserver/caddy/v2 | go | < 2.5.0 | 2.5.0 |
Miggo AIRoot Cause AnalysisThe critical commit b23bdcf in PR #4499 shows the fix involved reordering sanitization steps in MatchPath. Originally, it trimmed trailing dots/spaces before cleaning the path, which could leave unresolved '..' sequences after cleaning. This allowed attackers to craft URLs that bypass path normalization (e.g., '/..%2fevil.com' would become '/evil.com' after improper sanitization). The function's flawed order of operations directly enabled open redirects, as confirmed by the patch moving 'TrimRight' after path.Clean.
Ongoing coverage of React2Shell