CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
Attackers can bypass file hiding rules in Caddy by using case variations, exposing sensitive files intended to be hidden.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92700?
CVE-2026-92700 is a medium-severity vulnerability in caddyserver caddy, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.
Weakness: CWE-178
Which versions are affected by CVE-2026-92700?
How do I fix CVE-2026-92700?
Upgrade to a fixed version.
Is CVE-2026-92700 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92700 exists.
Sources
Also known as DEBIAN-CVE-2026-92700, UBUNTU-CVE-2026-92700.