CVE-2026-92700: Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using Caddy 2.11.3 or earlier are exposed when file-server hide rules protect files on a case-insensitive filesystem, or when mixed-case path variants coexist. A request using different letter casing may reach a file that the configured hide pattern was intended to block.
What does an attacker need to exploit this?
An attacker needs the ability to request files from an affected Caddy file server and knowledge or a guess of a case variation for a hidden path. No authentication requirement is stated in the available information.
Are default Caddy configurations affected?
The issue concerns configured hide rules used by the file server. The available information does not establish that a default configuration includes affected hide rules.
How can I check whether a deployment is affected?
Check whether the deployment runs Caddy 2.11.3 or earlier and uses file-server hide patterns. Test whether alternate capitalization of paths matching those patterns can retrieve files on the deployed filesystem.