Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-52844
7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Caddy: Windows `file_server` path authorization bypass via encoded backslash
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
References
-
https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6 x_refsource_CONFIRMexploit
Affected products
caddy
- ==< 2.11.4
Matching in nixpkgs
pkgs.caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
pkgs.xcaddy
Build Caddy with plugins
pkgs.caddyfile-language-server
Basic language server for caddyfile
pkgs.vimPlugins.nvim-treesitter-parsers.caddy
Tree-sitter grammar for caddy
-
nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
-
nixos-26.05 0.0.0+rev=2686186
- nixos-26.05-small 0.0.0+rev=2686186
- nixpkgs-26.05-darwin 0.0.0+rev=2686186
pkgs.tree-sitter-grammars.tree-sitter-caddyfile
Tree-sitter grammar for caddyfile
-
nixos-unstable 0-unstable-2026-04-06
- nixpkgs-unstable 0-unstable-2026-04-06
- nixos-unstable-small 0-unstable-2026-04-06
-
nixos-26.05 0-unstable-2026-04-06
- nixos-26.05-small 0-unstable-2026-04-06
- nixpkgs-26.05-darwin 0-unstable-2026-04-06
pkgs.vscode-extensions.matthewpi.caddyfile-support
Rich Caddyfile support for Visual Studio Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
Package maintainers
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
-
@matthewpi Matthew Penner <me+nix@matthewp.io>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>