Detections
Analytics
CVE-2026-52844
medium
Description
Caddy project reports: Caddy 2.11.4 contains multiple security fixes. GitHub Security Advisory GHSA-qrp7-cvwr-j2c6 reports: Windows-encoded backslashes in request paths could bypass path-scoped authorization rules before files are served by file_server. GitHub Security Advisory GHSA-f59h-q822-g45g reports: forward_auth copy_headers could fail to remove underscore aliases of copied identity headers before FastCGI header normalization, allowing identity or group header spoofing. GitHub Security Advisory GHSA-vcc4-2c75-vc9v reports: The stripHTML template function could fail to remove malformed HTML, potentially allowing client-side cross-site scripting if untrusted output is later rendered as HTML.