CVE-2026-27585
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
- Affected products
- Caddy
- Caddyserver Caddy
- < 2.11.1
- Fix
- Available
- CVSS 4.0
- 8.2 HIGH
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.3% (25th percentile)
- Weakness
- CWE-20
- NVD status
- Analyzed
- Published
- 2026-02-24
CVE-2026-27585 at NVD
No indexed exploits for CVE-2026-27585 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-27585 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.