{
  "cveId": "CVE-2026-27585",
  "url": "https://patchblox.com/security/cve/CVE-2026-27585",
  "summary": "CVE-2026-27585 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-27585, released February 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "caddy: Caddy is an extensible server platform that uses TLS by default",
  "description": "Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn\u0027t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.",
  "published": "2026-02-24T17:29:03Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00367,
  "epssPercentile": 0.30798,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "caddy",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.6.2-5\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2026-27585",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-27585",
      "released": "2026-02-24T17:29:03Z"
    },
    {
      "platform": "linux",
      "product": "caddy",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.6.2-12\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-27585",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-27585",
      "released": "2026-02-24T17:29:03Z"
    },
    {
      "platform": "linux",
      "product": "caddy",
      "release": "Debian 14",
      "fixedVersion": "2.11.2-1",
      "fix": "DEBIAN-CVE-2026-27585",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-27585",
      "released": "2026-02-24T17:29:03Z"
    },
    {
      "platform": "linux",
      "product": "caddy",
      "release": "Fedora 43",
      "fixedVersion": "2.10.2-9.fc43",
      "fix": "FEDORA-2026-3DC324BD9A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3dc324bd9a",
      "released": "2026-06-23T21:10:09Z"
    },
    {
      "platform": "linux",
      "product": "caddy-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "2.10.2-9.fc43",
      "fix": "FEDORA-2026-3DC324BD9A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3dc324bd9a",
      "released": "2026-06-23T21:10:09Z"
    },
    {
      "platform": "linux",
      "product": "caddy-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "2.10.2-9.fc43",
      "fix": "FEDORA-2026-3DC324BD9A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3dc324bd9a",
      "released": "2026-06-23T21:10:09Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.0.20260226T182644-150000.1.149.1",
      "fix": "SUSE-SU-2026:0757-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0757-1",
      "released": "2026-03-03T11:34:04Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}