CVE-2026-27585: caddyserver caddy Improper Input Validation
Vulnerability summary
CVE-2026-27585 is a medium (CVSS 6.9) Improper Input Validation vulnerability in caddyserver caddy. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 24-02-2026PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · GoEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.09 pp
From 0.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCaddy
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Caddyserver1 product
- caddy< 2.11.1
Debian1 product
- caddyAll versions (No fix recorded) | < 2.6.2-12+deb13u1 | < 2.11.2-1
Github.com/caddyserver/caddy1 product
- v2< 2.11.1
Ubuntu1 product
- caddyAll versions (No fix recorded)
4 vendors · 4 products
References
11 links- github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4X Refsource CONFIRMREPORTWEBAdvisoryExploitVendor Advisory
- github.com/caddyserver/caddyPACKAGE