Security Advisory

CVE-2026-45692

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-23 17:55:11

Last updated 2026-06-26 18:16:37

Assigner GitHub_M

CVSS score 5.4

State PUBLISHED

Description

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

← Browse all CVEs View on cve.org ↗