CVE-2026-27585
Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections
概要
Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-27585 caddy
- Ubuntu UBUNTU-CVE-2026-27585 caddy
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com