Path Traversal in Caddy Web Server

Executive Summary

CVE-2026-52844 is a high-severity vulnerability in the Caddy server on Windows platforms. It occurs because Caddy's path matchers treat backslashes in URLs differently than the file system does. Specifically, a path like /private\secret.txt is considered outside the protected /private/* directory by the path matcher, but the file_server component resolves it as a file inside the protected directory on disk. This inconsistency allows an unauthenticated remote attacker to bypass path-based authorization and access files that should be restricted.

The root cause is the inconsistent handling of path separators: Caddy's route matchers use URL path semantics (forward slashes), while the Windows filesystem uses backslashes. Attackers exploit this by sending requests with encoded backslashes to access sensitive files within protected directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files within protected directories on a Caddy server running on Windows. An attacker can bypass authentication and authorization controls designed to restrict access to certain paths, potentially exposing confidential information such as credentials, backups, or configuration files.

The impact is primarily a high confidentiality loss, as attackers can read files they should not have access to. However, it does not allow attackers to traverse outside the configured site root or cause integrity or availability damage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests that contain encoded backslashes (%5c) in paths that should be protected, such as requests to paths like /private%5csecret.txt.

You can use network traffic inspection tools or web server logs to identify such suspicious requests attempting to bypass path-based authorization.

For example, using command-line tools like grep on access logs to find requests with %5c in the URL path:

• grep "%5c" /path/to/caddy/access.log

Alternatively, using network packet capture tools like tcpdump or Wireshark to filter HTTP requests containing %5c in the URI can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Caddy to version 2.11.4 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, consider implementing additional access controls or filters to block requests containing encoded backslashes (%5c) in URLs to prevent bypassing path-based authorization.

Also, review your Caddy configuration to ensure that path matchers and file_server directives are properly aligned and consider normalizing or rejecting requests with backslashes before authorization checks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated remote attacker to bypass path-based authorization restrictions and gain unauthorized access to sensitive files such as credentials, backups, or configuration files within protected directories.

Such unauthorized access to sensitive data can lead to a high confidentiality loss, which may result in non-compliance with data protection standards and regulations like GDPR and HIPAA that require strict access controls and protection of personal or sensitive information.

Therefore, if exploited, this vulnerability could cause organizations using affected Caddy versions to fail compliance requirements related to data confidentiality and access control.

Useful 0 Not Useful 0