ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-52844

Windows path authorization bypass via encoded backslash

Published Jun 8, 2026 · catalog updated Jun 8, 2026 · Windows path authorization bypass

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-52844. EPSS is 0.62%. Act only if a listed version of Windows path authorization bypass is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Windows path authorization bypass).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.62%
Remediation
Not established
Affected products
See sources for product scope

### Summary On Windows, Caddy matchers treat as outside , but later resolves the same request path as on disk. An unauthenticated remote client can request and bypass Caddy path-scoped auth/deny routes protecting . ### Details The mismatch is between two Caddy code paths: - compares using URL path semantics and does not normalize to : , , , . - If the route matcher misses, Caddy skips that route: . - then maps the same request path to a filesystem path with : , , . - On Windows, Go filesystem path handling treats as a separator, so the default filesystem opens the file under the protected directory: . This is related to, but distinct from, . That advisory fixed backslash handling in the matcher / glob path. This report does not use or the matcher; it affects ordinary route matchers in front of direct serving and reproduces on current HEAD. ### PoC Tested on current HEAD with a Windows built from this repository. On Windows, create the test files and Caddyfile: Start Caddy: Baseline request, expected to be blocked: Observed: Bypass request: Observed: Uppercase produces the same result. Relevant debug log lines: ### Impact This is a Windows-only remote authorization bypass for deployments that protect static subtrees with Caddy path matchers before . This pattern is documented by Caddy itself, for example followed by . An attacker can read files that were intended to be protected by Caddy-side , , or other path-scoped handlers. The issue does not escape the configured site root; traversal is still blocked. The practical impact is sensitive file disclosure inside the protected subtree, with higher impact if that subtree contains backups, database files, exported admin data, credentials, or signing/session secrets. ### Suggested Fix Normalize Windows path separators consistently before evaluates request paths, or reject request paths containing before resolves them as filesystem separators. The important invariant is that a request path used for route authorization must

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-52844

  • No stored fix

    No vendor fix text is stored. Use the linked advisory before you change production.

  • Version check

    No version range is stored, so an installed version cannot be checked on this page.

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-52844. EPSS is 0.62%. Act only if a listed version of Windows path authorization bypass is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal; CWE-284: Improper Access Control. EPSS 0.62%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Caddy securityWindows security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 8, 2026 · Maintainer security tabs

    Detected

    ### Summary On Windows, Caddy matchers treat as outside , but later resolves the same request path as on disk. An unauthenticated remote client can request and bypass Caddy path-scoped auth/deny routes protecting . ### Details The mismatch is between two Caddy code paths: - compares using URL path semantics and does not normalize to : , , , . - If the route matcher misses, Caddy skips that route:

  2. Jun 8, 2026 · Maintainer security tabs

    Updated

    ### Summary On Windows, Caddy matchers treat as outside , but later resolves the same request path as on disk. An unauthenticated remote client can request and bypass Caddy path-scoped auth/deny routes protecting . ### Details The mismatch is between two Caddy code paths: - compares using URL path semantics and does not normalize to : , , , . - If the route matcher misses, Caddy skips that route:

Sources

  • Maintainer security tabsVendor advisoryGHSA-qrp7-cvwr-j2c6

    ### Summary On Windows, Caddy matchers treat as outside , but later resolves the same request path as on disk. An unauthenticated remote client can request and bypass Caddy path-scoped auth/deny routes protecting . ### Details The mismatch is between two Caddy code paths: - compares using URL path semantics and does not normalize to : , , , . - If the route matcher misses, Caddy skips that route:

    github.com

Freshness

Last verified in this catalog Nov 1, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 1, 2026