Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Date: 2026-02
Affected: go/github.com/caddyserver/caddy/v2
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27585
CWE: CWE-20

### Summary The path sanitization in [file matcher](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) doesn't sanitize backslashes which can lead to bypassing path related security protections. ### Details The [try_files](https://caddyserver.com/docs/caddyfile/directives/try_files) directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It's commonly used in Caddy configs. For example, it's used in SPA applications to rewrite every route that doesn't exist as a file to `index.html`. ```caddy example.com { root * /srv encode try_files {path} /index.html file_server } ``` `try_files` patterns are actually glob patterns and file matcher expands them. The `{path}` in the pattern is replaced with the request path and then [is expanded by `fs.Glob`](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L398). The request path is sanitized before being placed inside the pattern and the special chars are escaped . [The following code](https://github.com/caddyserver/caddy/blob/68d50020eef0d4c3398b878f17c8092ca5b58ca0/modules/caddyhttp/fileserver/matcher.go#L361) is the sanitization part. ```go var globSafeRepl = strings.NewReplacer( "*", "\\*", "[", "\\[", "?", "\\?", ) expandedFile, err := repl.ReplaceFunc(file, func(variable


Mitigations:

Architectural layers (MAESTRO):