Summary
CVE-2026-52844 is a high-severity authorization bypass vulnerability in the Caddy web server affecting Windows deployments running versions prior to 2.11.4. The flaw arises from an inconsistency between Caddy’s path matchers and its file_server module in how URL-encoded backslash characters (%5c) are handled, allowing an unauthenticated remote attacker to access files in path-protected directories that should be blocked by configured access controls. The CVSS v3.1 base score is 7.5 (High).
Technical details
- Root cause: Caddy’s path matchers evaluate request URLs without normalizing
%5c(URL-encoded backslash) to a forward slash. When a path like/private%5csecret.txtis evaluated against a route protecting/private/*, the matcher does not recognize it as being inside the protected subtree and allows the request to pass. Thefile_servermodule subsequently resolves the same path to disk, where Windows treats the backslash as a directory separator — effectively readingprivatesecret.txtfrom the protected directory. - Trigger conditions: The target Caddy instance must be running on Windows and must use path-scoped access controls (e.g.,
basic_authordenydirectives) in front offile_serverfor a protected path prefix such as/private/*. - Attack vector: An unauthenticated remote attacker sends an HTTP request with a URL-encoded backslash in the path (e.g.,
GET /private%5csecret.txt), bypassing the configured route authorization without credentials. - Impact: Confidentiality impact is HIGH. An attacker can read arbitrary files within protected directory trees — including credentials, configuration files, backups, or other sensitive data served by
file_server— without any authentication.
Affected software
- Caddy (caddyserver/caddy) — all versions prior to 2.11.4 running on Windows
- Caddy deployments on Linux and macOS are not affected
Severity
- CVSS v3.1 Base Score: 7.5 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CWE-22 (Improper Limitation of a Pathname to a Restricted Directory – Path Traversal)
- CWE-284 (Improper Access Control)
Mitigation and recommended actions
- Immediate: Upgrade to Caddy v2.11.4 or later, which normalizes Windows backslashes in the path matcher before route evaluation, ensuring consistent behavior between the matcher and
file_server. - If immediate patching is not possible: No vendor-documented workaround exists. As a temporary network-level mitigation, consider restricting access to affected Caddy instances to trusted IP ranges and auditing which paths are protected by
file_serverwith path-scoped access controls on Windows hosts.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

