CVE-2026-52844

Go/github.com/caddyserver/caddy/v2 CVE-2026-52844: high 7.5, EPSS 0.62%

Caddy: Windows `file_server` path authorization bypass via encoded backslash

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.

go get github.com/caddyserver/caddy/v2@v2.11.4

Affected

Fixed versions

Sources

• osv: GHSA-qrp7-cvwr-j2c6
• https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6
• https://nvd.nist.gov/vuln/detail/CVE-2026-52844
• https://github.com/caddyserver/caddy

CVE-2026-52844 · published 2026-06-16T21:28:11Z · modified 2026-07-24T19:11:20.687133571Z · JSON

Go/github.com/caddyserver/caddy CVE-2026-52844: high 7.5, EPSS 0.62%

Caddy: Windows `file_server` path authorization bypass via encoded backslash

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-qrp7-cvwr-j2c6#Go/github.com/caddyserver/caddy
• https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6
• https://nvd.nist.gov/vuln/detail/CVE-2026-52844
• https://github.com/caddyserver/caddy

CVE-2026-52844 · published 2026-06-16T21:28:11Z · modified 2026-07-24T19:11:20.687133571Z · JSON

Go/github.com/caddyserver/caddy/v2 CVE-2026-52844: unknown, EPSS 0.62%

Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

Action: Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.

go get github.com/caddyserver/caddy/v2@v2.11.4

Affected

Fixed versions

Sources

• osv: GO-2026-5595
• https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6

CVE-2026-52844 · published 2026-07-24T18:35:55Z · modified 2026-07-24T19:00:24.317153778Z · JSON