CVE-2026-52844 Caddy: Windows `file_server` path authorization bypass via encoded backslash
An attacker can bypass path-based authorization on Windows to access protected files by using encoded backslashes in the request path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52844?
CVE-2026-52844 is a high-severity path traversal vulnerability in caddyserver caddy, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Which versions are affected by CVE-2026-52844?
5 open source packages ship an affected version, including github.com/caddyserver/caddy/v2 and github.com/caddyserver/caddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
Products include Caddyserver Caddy.
How do I fix CVE-2026-52844?
Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-52844 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52844 exists.
Other vulnerabilities in caddyserver caddy
- CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Sources
Also known as CLEANSTART-2026-QE63753, GHSA-qrp7-cvwr-j2c6, GO-2026-5595, MINI-whvf-68r5-h8f5, MINI-wr6f-fcr7-4j65, UBUNTU-CVE-2026-52844.