CVE-2026-27585
2 advisories.
Go/github.com/caddyserver/caddy/v2 CVE-2026-27585: medium
Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.1 or later.
go get github.com/caddyserver/caddy/v2@v2.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.11.1 | - |
Fixed versions
| 2.11.1 |
Sources
- osv: GHSA-4xrr-hq4w-6vf4
- https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4
- https://nvd.nist.gov/vuln/detail/CVE-2026-27585
- https://caddyserver.com/docs/caddyfile/directives#directive-order
- https://github.com/caddyserver/caddy
- https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361
- https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1
- https://pkg.go.dev/vuln/GO-2026-4535
CVE-2026-27585 · published · modified · JSON
Go/github.com/caddyserver/caddy/v2 CVE-2026-27585: unknown
Improper sanitization of glob characters in github.com/caddyserver/caddy/v2
Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.1 or later.
go get github.com/caddyserver/caddy/v2@v2.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.11.1 | - |
Fixed versions
| 2.11.1 |
Sources
- osv: GO-2026-4535
- https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4
- https://caddyserver.com/docs/caddyfile/directives#directive-order
- https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361
- https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398
- https://github.com/caddyserver/caddy/releases/tag/v2.11.1
CVE-2026-27585 · published · modified · JSON