Nixpkgs security tracker
5.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
References
-
https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc x_refsource_CONFIRM
Affected products
- ==>= 2.4.0, < 2.11.3
Matching in nixpkgs
pkgs.caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
pkgs.xcaddy
Build Caddy with plugins
pkgs.caddyfile-language-server
Basic language server for caddyfile
pkgs.vimPlugins.nvim-treesitter-parsers.caddy
Tree-sitter grammar for caddy
-
nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
-
nixos-26.05 0.0.0+rev=2686186
- nixos-26.05-small 0.0.0+rev=2686186
- nixpkgs-26.05-darwin 0.0.0+rev=2686186
pkgs.tree-sitter-grammars.tree-sitter-caddyfile
Tree-sitter grammar for caddyfile
-
nixos-unstable 0-unstable-2026-04-06
- nixpkgs-unstable 0-unstable-2026-04-06
- nixos-unstable-small 0-unstable-2026-04-06
-
nixos-26.05 0-unstable-2026-04-06
- nixos-26.05-small 0-unstable-2026-04-06
- nixpkgs-26.05-darwin 0-unstable-2026-04-06
pkgs.vscode-extensions.matthewpi.caddyfile-support
Rich Caddyfile support for Visual Studio Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
Package maintainers
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
-
@matthewpi Matthew Penner <me+nix@matthewp.io>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>