CVE-2026-27585: Caddyserver Caddy Path Traversal Flaw

CVE-2026-27585 Overview

CVE-2026-27585 is a path sanitization bypass vulnerability in Caddy, an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in the file matcher fails to properly sanitize backslashes, which can lead to bypassing path-related security protections. This vulnerability affects users with specific Caddy and environment configurations.

Critical Impact

Attackers may exploit improper backslash handling in path sanitization to bypass security controls, potentially accessing restricted files or directories through crafted requests containing backslash characters.

Affected Products

• Caddyserver Caddy versions prior to 2.11.1
• Systems running Caddy with file matcher configurations
• Environments where path-based security controls are enforced

Discovery Timeline

• 2026-02-24 - CVE-2026-27585 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27585

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in Caddy's file matcher component. The path sanitization routine is designed to normalize and clean incoming request paths to prevent directory traversal and other path manipulation attacks. However, the implementation fails to account for backslash characters (\), which on certain operating systems (particularly Windows) serve as valid path separators.

When an attacker crafts a request containing backslashes instead of forward slashes, the sanitization routine does not properly convert or filter these characters. This oversight allows malicious actors to construct paths that bypass security checks while still resolving to restricted file system locations on the server.

The impact of this vulnerability is primarily focused on integrity, as attackers may gain unauthorized access to files or directories that should be protected by path-based security controls. The vulnerability requires specific environmental conditions to exploit, notably configurations where path matching is used for access control decisions.

Root Cause

The root cause is insufficient character handling in the path sanitization logic within the matcher.go file. The sanitization function processes forward slashes for path normalization but does not apply equivalent treatment to backslash characters. This creates an inconsistency between the security validation layer and the underlying file system resolution, enabling path traversal techniques using alternate path separators.

The vulnerable code resides in the file server matcher module, specifically in functions responsible for path matching and validation. The sanitization routine was designed with forward-slash semantics in mind but failed to account for cross-platform path separator differences.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send HTTP requests with specially crafted paths containing backslash characters to bypass path-based security rules configured in the Caddy server.

The attack scenario involves:

1. Identifying a Caddy server with file matcher configurations that enforce path-based access restrictions
2. Crafting HTTP requests using backslash characters (e.g., GET /protected\..\secret\file.txt) instead of forward slashes
3. Bypassing the path sanitization routine to access restricted resources

For technical implementation details, refer to the vulnerable code sections in matcher.go and the GitHub Security Advisory.

Detection Methods for CVE-2026-27585

Indicators of Compromise

• HTTP requests containing backslash characters (\) in URL paths, particularly in combination with path traversal sequences
• Access log entries showing unusual path patterns with mixed forward and backslash characters
• Requests targeting sensitive files or directories with non-standard path separators
• Increased 200 responses to paths that should return 403 or 404

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing backslash characters in URL paths
• Configure log monitoring to alert on requests with mixed path separator usage
• Deploy intrusion detection signatures looking for path traversal patterns using backslash sequences
• Enable verbose access logging on Caddy servers to capture full request paths for forensic analysis

Monitoring Recommendations

• Monitor Caddy access logs for requests containing encoded or literal backslash characters
• Establish baseline metrics for file access patterns and alert on anomalies indicating unauthorized path access
• Implement file integrity monitoring for sensitive directories that could be targeted via path bypass

How to Mitigate CVE-2026-27585

Immediate Actions Required

• Upgrade Caddy to version 2.11.1 or later immediately
• Review Caddy configurations that rely on path-based security controls and assess potential exposure
• Implement temporary WAF rules to block requests containing backslash characters in paths
• Audit access logs for signs of exploitation attempts prior to patching

Patch Information

The vulnerability has been addressed in Caddy version 2.11.1. The fix properly handles backslash characters in the path sanitization routine, ensuring consistent security enforcement regardless of path separator usage. Organizations should upgrade to this version or later to remediate the vulnerability.

For patch details and release information, see the CaddyServer Release v2.11.1.

Workarounds

• Deploy a reverse proxy or WAF in front of Caddy to normalize path separators before requests reach the server
• Implement request filtering at the network level to reject requests containing backslash characters in URL paths
• Temporarily disable file matcher configurations that enforce security-critical path restrictions until patching is complete
• Use operating system-level file permissions as an additional layer of defense for sensitive files

# Example: Nginx reverse proxy configuration to normalize backslashes
# Place this in front of your Caddy server as a temporary workaround
location / {
    # Reject requests with backslashes in the path
    if ($request_uri ~* "\\\\") {
        return 400;
    }
    proxy_pass http://caddy_backend;
}