Go/github.com/caddyserver/caddy/v2 CVE-2026-52844: unknown, EPSS 0.62%

Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.

go get github.com/caddyserver/caddy/v2@v2.11.4

Affected

Fixed versions

Sources

• osv: GO-2026-5595
• https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6

CVE-2026-52844 · published 2026-07-24T18:35:55Z · modified 2026-07-24T19:00:24.317153778Z · JSON