Caddy is vulnerable to a security bypass flaw in file handling that could allow unauthenticated attackers to access sensitive files intended to be hidden on case-insensitive filesystems.

The vulnerability resides in the fileHidden function within modules/caddyhttp/fileserver/staticfiles.go, which utilizes case-sensitive filepath matching. This implementation allows unauthenticated attackers to bypass file hiding rules by using mixed-case path variants on specific filesystem configurations.

Successful exploitation may lead to unauthorized disclosure of sensitive configuration files or protected data that the administrator intended to keep private. While the CVSS score of 6.3 indicates a medium severity, the ability to bypass access controls directly threatens the confidentiality of the server environment. This risk is particularly elevated for organizations hosting sensitive applications on case-insensitive platforms like Windows or macOS.

Immediate Action: Update Caddy to version 2.11.4 or later immediately to incorporate the corrected case-insensitive path matching logic.

Proactive Monitoring: Review web server access logs for anomalous requests attempting to access sensitive files with unusual casing, which may indicate probing for this vulnerability.

Compensating Controls: Implement strict file system permissions to ensure that even if the web server logic is bypassed, the service account lacks read access to sensitive files that should not be served.

Public Exploit Available: No

Given the availability of a patch and the nature of this bypass vulnerability, administrators should prioritize updating to version 2.11.4 during the next maintenance window. Failure to address this flaw could result in the inadvertent exposure of private server assets.