Improper Neutralization of Equivalent Special Elements Affecting github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver package, versions <2.11.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMCADDYSERVERCADDYV2MODULESCADDYHTTPFILESERVER-15340909
- published25 Feb 2026
- disclosed24 Feb 2026
- creditparrot409
Introduced: 24 Feb 2026
CVE-2026-27585 Â (opens in a new tab)How to fix?
Upgrade github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver to version 2.11.0 or higher.
Overview
github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver is a fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Affected versions of this package are vulnerable to Improper Neutralization of Equivalent Special Elements in matcher.go‎, when matching filenames using the try_files directive, which does not properly handle backslashes. An attacker can bypass security protections by exploiting glob pattern expansion. This is only exploitable if the configuration separates the try_files directive and the filtering route or handle directives into different blocks, or if certain directive execution orders allow the bypass.
Note: From the 2.11 release notes: "There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1."