7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52844

CVE-2026-52844: Caddy: Windows `file_server` path authorization bypass via encoded backslash

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/. This vulnerability is fixed in 2.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52844

CVE-2026-52844:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/caddyserver/caddy/v2	go	< 2.11.4	2.11.4
github.com/caddyserver/caddy	go	<= 1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in the advisory GHSA-qrp7-cvwr-j2c6, is a path traversal issue on Windows caused by inconsistent handling of backslashes between the path matching component and the file server component of Caddy. The advisory explicitly points to MatchPath.MatchWithError() as the function that fails to normalize backslashes. Analysis of the patch in commit 217a78582465e33498276aff83d9aaeb63a2f88a confirms this. The changes are confined to modules/caddyhttp/matchers.go and directly target the MatchPath.MatchWithError function. The patch introduces code to replace backslashes (\) and their encoded variants (%5c, %5C) with forward slashes (/) on Windows platforms before any path matching occurs. This directly remediates the described vulnerability. Therefore, caddyhttp.MatchPath.MatchWithError is the precise location of the vulnerable code that, when exploited, would lead to an authorization bypass.

Vulnerable functions

caddyhttp.MatchPath.MatchWithError

modules/caddyhttp/matchers.go

The vulnerability lies in the `MatchPath.MatchWithError` function, which is responsible for matching request paths against configured security policies. On Windows, this function did not properly normalize backslashes in URL paths. An attacker could send a request with a URL-encoded backslash (e.g., `%5c`) which would not be treated as a path separator by the matcher, thus bypassing path-based authorization rules like `/private/*`. However, the underlying `file_server` on Windows would correctly interpret the backslash, allowing access to protected files. The patch fixes this by explicitly normalizing backslashes to forward slashes before the matching logic is executed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.