IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
6.3Orta

CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

caddyserver caddy Yayım: (1 ay önce)

Açıklama

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.

Zayıflık türü (CWE): CWE-178

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
caddyserver caddy <= 2.11.3

Kaynaklar ve yamalar

Aynı üründe son açıklar — Caddy

6.5Orta
CVE-2026-77281

Caddy: rewrite placeholder re-expansion

caddyserver caddy

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-con…