CVE-2026-92700
Received Received - Intake

File Hidden Bypass in Caddy Web Server

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-92700
EUVD
EUVD-2026-85515

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
caddy_project caddy to 2.11.4 (exc)
caddyserver caddy to 2.11.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-92700 affects Caddy versions up to 2.11.3 and involves three vulnerabilities. The first allows environment variable or file disclosure through placeholder double-expansion in rewrite URIs. The second causes a denial-of-service by unbounded memory usage when processing request bodies. The third enables bypassing file hiding rules using case variations due to case-sensitive matching in the fileHidden() function.

Detection Guidance

Check Caddy version with 'caddy version' to confirm if it is v2.11.3 or earlier. Inspect configuration files for rewrite rules using placeholders ending with '?' or file hiding rules that may be bypassed by case variations.

Impact Analysis

An attacker could exploit these vulnerabilities to access sensitive files like .git directories or .env files, disclose environment variables or files, or cause system instability by exhausting memory. This could lead to unauthorized data access, service disruption, or further attacks on the system.

Compliance Impact

Exposure of sensitive files or environment variables could result in violations of data protection regulations like GDPR or HIPAA, leading to legal penalties, reputational damage, or loss of compliance certifications. Unauthorized access to personal or health data would be particularly severe.

Mitigation Strategies

Upgrade Caddy to a patched version beyond v2.11.3. Review and sanitize rewrite URI templates to prevent placeholder double-expansion. Implement size limits for request body buffering in configurations. Adjust file hiding rules to use case-insensitive matching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart