Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Caddy Web Server Improper Input Validation Vulnerability - CVE-2026-27585 - Vulnerability Database
Caddy Web Server

Caddy Web Server Improper Input Validation Vulnerability - CVE-2026-27585

Medium
Reference: CVE-2026-27585
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-27585
Title: Caddy Web Server Improper Input Validation Vulnerability
Overview:

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1 the path sanitization routine in file matcher doesn39t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.