Path traversal in Caddy - #VU163186
Published: November 9, 2026
Vulnerability identifier: #VU163186
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read files outside the intended document root that the Caddy process can access.
The vulnerability exists due to insufficient validation of request host values used in Caddy document roots such as /srv/sites/{host} on catch-all or on-demand TLS sites. An unauthenticated remote attacker can supply dot segments or slashes in host values to traverse directories and retrieve files through the file server.
Affected software
Caddy
Remediation
Install security update from vendor's website.
Caddy - update to 2.11.8