Improper access control in Caddy - CVE-2026-52844
Published: November 9, 2026
Vulnerability identifier: #VU163181
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52844
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read protected static files in Windows Caddy deployments that enforce access restrictions through path matchers.
The vulnerability exists due to inconsistent backslash handling between Caddy path matchers and file_server on Windows when a request contains an encoded backslash. An unauthenticated remote attacker can request /private%5csecret.txt to bypass restrictions on /private/* and retrieve protected files within the configured site root.
Affected software
Caddy
How to mitigate CVE-2026-52844
Install security update from vendor's website.
Caddy - update to 2.11.4