Improper Resolution of Path Equivalence in Caddy - #VU163187
Published: November 9, 2026
Vulnerability identifier: #VU163187
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-41
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read static files that Caddy configurations protect with suffix or exact path rules.
The vulnerability exists due to inconsistent path normalization in Caddy's file matcher when try_files {path} follows those blocking rules, allowing trailing slash components to resolve to regular files. An unauthenticated remote attacker can request /.env/./ to bypass the earlier rule and retrieve the protected file's contents.
Affected software
Caddy
Remediation
Install security update from vendor's website.
Caddy - update to 2.11.8