SB20261109225 - Multiple vulnerabilities in Caddy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109225

SB20261109225 - Multiple vulnerabilities in Caddy

Published: November 9, 2026

Security Bulletin ID SB20261109225
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Files or Directories Accessible to External Parties (CVE-ID: N/A)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to download TLS private keys and local certificate authority keys from Caddy.

The vulnerability exists due to Caddy storing sensitive data in ./caddy when neither HOME nor XDG_DATA_HOME is set and exposing it through a file server rooted at the working directory. An unauthenticated remote attacker can request the exposed keys to impersonate the site or mint certificates trusted by clients that installed the local certificate authority.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read files outside the intended document root that the Caddy process can access.

The vulnerability exists due to insufficient validation of request host values used in Caddy document roots such as /srv/sites/{host} on catch-all or on-demand TLS sites. An unauthenticated remote attacker can supply dot segments or slashes in host values to traverse directories and retrieve files through the file server.


3) Improper Resolution of Path Equivalence (CVE-ID: N/A)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read static files that Caddy configurations protect with suffix or exact path rules.

The vulnerability exists due to inconsistent path normalization in Caddy's file matcher when try_files {path} follows those blocking rules, allowing trailing slash components to resolve to regular files. An unauthenticated remote attacker can request /.env/./ to bypass the earlier rule and retrieve the protected file's contents.


4) Double Decoding of the Same Data (CVE-ID: N/A)

CWE-ID: CWE-174 - Double Decoding of the Same Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read static files protected by path-based deny rules on affected Caddy sites.

The vulnerability exists due to double decoding of unescaped {http.matchers.file.remainder} values in Caddy's rewrite handler when sites rewrite using this placeholder after path-based deny checks. An unauthenticated remote attacker can submit double-encoded traversal sequences in path information to bypass those checks and retrieve protected files through the file server.


5) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to bypass path-based authorization and execute protected PHP scripts, exposing sensitive output.

The vulnerability exists due to inconsistent path interpretation between Caddy's access-control matchers and FastCGI transport when php_fastcgi skips rewriting, including when the configured index file is absent. An unauthenticated remote attacker can send a dot-segment request ending in a nonexistent PHP path to execute an existing protected script without credentials.


Remediation

Install update from vendor's website.

References