CVE-2026-92700

Executive Summary

CVE-2026-92700 is a case-sensitivity weakness in Caddy's static file server module, where case-variant path inspection can bypass configured hide rules and expose files that administrators intended to be inaccessible. Caddy instances running version 2.11.3 and earlier that rely on hide rules for defense-in-depth are affected, particularly when hosted on case-insensitive filesystems or when mixed-case path variants coexist. The impact is limited to information disclosure — unauthorized read access to hidden static assets — rather than remote code execution or privilege escalation.

Technical Analysis

Caddy is an extensible server platform that uses TLS by default and is widely deployed as a reverse proxy and static file host. The vulnerability resides in the fileserver package at modules/caddyhttp/fileserver/staticfiles.go. Specifically, the fileHidden() routine uses filepath.Match to evaluate whether a requested path matches an administrator-defined hide rule. filepath.Match performs case-sensitive pattern evaluation on the resulting name.

This creates a mismatch between two distinct layers of path interpretation:

1. Application-layer matching (Caddy): Case-sensitive. A hide rule such as a pattern matching *.secret or a specific filename will only match if the request path presents the exact casing used in the rule.
2. Filesystem-layer resolution (OS): On case-insensitive filesystems (default behavior on Windows and macOS, and optionally on some Linux mounts such as case-insensitive ext4 directories or certain network shares), the operating system resolves SECRET, Secret, and secret to the same underlying file.

The consequence is a bypass of a control that administrators treat as an access restriction. When Caddy evaluates fileHidden() against a request containing altered casing, the case-sensitive match fails, the hide rule is not applied, and Caddy proceeds to serve the file. The filesystem then resolves the variant path to the same on-disk object. Two exploitable conditions are described: (a) hosting on a case-insensitive filesystem, and (b) environments where mixed-case path variants coexist within the served root, allowing a variant name to satisfy the path resolution while evading the pattern match.

CWE-178 (Improper Handling of Case Sensitivity) accurately characterizes this flaw. The security boundary is not memory safety or input sanitization but semantic inconsistency between a filtering routine and the underlying storage. Note that no CWE-22 path traversal is involved — this is not ../ escaping, but rather a pure case-normalization discrepancy within a single logical path.

The attack surface is any statically served tree fronted by an affected Caddy build where hide rules protect sensitive artifacts. Because Caddy uses TLS by default, the exposure is typically over HTTPS on ports 443 or other configured listener ports, and the requests are ordinary HTTP GET operations indistinguishable in protocol shape from benign traffic.

At the time of writing, no public proof-of-concept, exploit code, or Nuclei template is available, and no vendor patch has been identified (patch confidence 0/4). CVSS scoring is unavailable from NVD, and FIRST.org has not yet assigned an EPSS value. The CVSS vector included in this report is an analyst-derived estimate based on the confidentiality-only, network-reachable, low-complexity nature of the flaw and should not be treated as an authoritative NVD score.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-178) and the specific behavior described in the NVD Description.

1. Reconnaissance / target identification. The adversary identifies Caddy servers serving static content. Shodan-style queries such as product:"Caddy" or http.html:"Caddy" can surface internet-facing instances. Attackers then seek evidence of hide rules in use — for example, administrative files, backup artifacts, configuration fragments, private keys, .git metadata, or documentation that a well-configured deployment would normally conceal. Because a bypassed file returns HTTP 200 with content while a genuinely absent file returns 404, the attacker can enumerate candidate names.

2. Triggering the flaw class. The attacker issues an HTTP request for a target path using case variation. For example, if the site hides a file through a rule matched case-sensitively against a lowercase pattern, the attacker requests the same logical name with uppercase or mixed-case characters. On a case-insensitive filesystem, filepath.Match in fileHidden() fails to associate the request with the hide rule, so the file is not marked hidden, while the filesystem still resolves the variant to the intended file.

3. Payload / execution method at the vulnerability-class level. No code execution is required. Exploitation consists of crafting GET requests with manipulated casing in the URL path. There is no injection payload in the traditional sense; the "payload" is the case-varied path itself. Requests may be sent manually or via automated fuzzing over case permutations of known or guessed filenames.

4. Post-exploitation impact. Successful requests disclose the contents of files an operator intended to hide. Depending on what is concealed, this could expose credentials, tokens, keys, internal documentation, or source artifacts. The flaw does not by itself grant code execution, authentication bypass, or write access; its risk is proportional to the sensitivity of the hidden files and their usefulness for follow-on attacks.

Impact Assessment

The impact is confidentiality-only, mapped to CWE-178. Estimated subscores on the CVSS 3.1 scale: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required None (PR:N), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N) — yielding a base estimate of 5.3 (Medium). This estimate is analyst-derived because NVD has not published a score for this CVE.

• Affected systems: Any Caddy deployment at version 2.11.3 or earlier that serves static files and depends on hide rules as a secrecy control. The risk is highest where the served filesystem is case-insensitive (Windows, macOS, or case-insensitive mounts on Linux and network shares) or where mixed-case name variants exist in the served root.
• Blast radius: Bounded to files within the served directory tree that are subject to hide rules. There is no lateral movement or privilege escalation intrinsic to this flaw.
• Business impact: Disclosure of files that administrators assumed were protected can lead to credential compromise, expanded attack surface, and compliance exposure if the hidden content includes personal data or regulated material. Because hide rules are often used as one layer of defense-in-depth rather than the sole authorization mechanism, the practical severity depends heavily on what is being hidden and whether additional access controls (authentication, network restrictions) are also in place.

Detection Guidance

Sigma Rule

title: Caddy Static File Hide Rule Bypass via Case Variation (CVE-2026-92700)
id: 8f3c1a2e-9b6d-4d2f-9c7a-7e1b5a0d4c11
status: experimental
description: Detects HTTP requests to Caddy static file paths using case variants that may bypass case-sensitive hide rules
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92700
author: valtersit.com
logsource:
  category: webserver
  product: caddy
detection:
  selection_method:
    cs-method: 'GET'
  selection_status:
    sc-status: 200
  filter_static:
    cs-uri-stem|endswith:
      - '.txt'
      - '.json'
      - '.bak'
      - '.old'
      - '.env'
      - '.key'
      - '.pem'
      - '.log'
      - '.yml'
      - '.yaml'
  selection_case_mix:
    cs-uri-stem|re: '.*[A-Z].*\.[A-Za-z0-9]+$'
  condition: selection_method and selection_status and filter_static and selection_case_mix
falsepositives:
  - Legitimate mixed-case filenames
  - Automated scanners generating case-permutation requests
level: medium

YARA Rule

rule CVE_2026_92700_Caddy_Case_Hide_Bypass
{
    meta:
        description = "Detects Caddy access log entries showing case-variant static file requests consistent with hide-rule bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92700"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $m_get = " GET "
        $caddy = "Caddy"
        $h_case = /[A-Z][a-z]+[A-Z]/
        $ext_bak = ".bak"
        $ext_env = ".env"
        $ext_key = ".key"
        $ext_old = ".old"

    condition:
        uint16(0) == 0x0A0A or filesize < 10MB
        and $caddy
        and $m_get
        and $h_case
        and any of ($ext_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92700 Caddy Static File Hide Rule Bypass via Case Variation"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/[A-Za-z0-9._-]*[A-Z][A-Za-z0-9._-]*\.(bak|old|env|key|pem|log|txt|json|ya?ml)$/"; reference:cve,CVE-2026-92700; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92700; classtype:attempted-recon; sid:9270001; rev:1; metadata:created_at 2026_01_01, confidence Medium, affected_product Caddy, cve CVE-2026-92700;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and url.path regex~ ".+[A-Z].+\\.(bak|old|env|key|pem|log|txt|json|ya?ml)$" ]
  [ network where http.response.status_code == 200 and url.path regex~ ".+[A-Z].+\\.(bak|old|env|key|pem|log|txt|json|ya?ml)$" ]

Splunk SPL Query

index=web sourcetype=caddy OR sourcetype=access_combined
| eval path=coalesce(uri_path, uri, url)
| where match(path, "^/[^ ]*[A-Z][^ ]*\.(bak|old|env|key|pem|log|txt|json|ya?ml)$")
| eval status=coalesce(status, sc_status, http_status)
| where status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(path) as paths by src_ip, host
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,caddy,cve-2026-92700,">
  <rule id="927000" level="6">
    <decoded_as>json</decoded_as>
    <field name="request.method">GET</field>
    <field name="response.status">200</field>
    <match>Caddy</match>
    <description>CVE-2026-92700: Possible Caddy static file hide rule bypass via case variation</description>
    <options>no_full_log</options>
  </rule>
  <rule id="927001" level="8">
    <if_sid>927000</if_sid>
    <regex type="pcre2">/[^ ]*[A-Z][^ ]*\.(bak|old|env|key|pem|log|txt|json|ya?ml)</regex>
    <description>CVE-2026-92700: Case-variant request for a potentially hidden Caddy static file</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Do not rely on hide rules alone to protect sensitive files. Remove or relocate artifacts that must truly be private so they are outside the served root entirely.
   • Prefer filesystem-level permissions and authenticated/authorized access over path-based hiding.
   • Where feasible, host Caddy on a case-sensitive filesystem, or normalize request paths (case folding) at an upstream reverse proxy before they reach Caddy.
   • Restrict internet exposure of static file trees that contain any sensitive material.
   • Monitor web logs for case-variant requests to hidden-looking filenames using the detection rules above.

2. Patch / upgrade steps:

   • No vendor patch has been identified. Track the Caddy project's releases and security advisories; upgrade to the first version that documents a fix for this issue once it becomes available.
   • Until a fix exists, treat all versions up to and including 2.11.3 as affected.

3. Long-term hardening:

   • Adopt a "deny by default" static file model: explicitly allowlist served content rather than hiding specific files.
   • Enforce consistent case normalization across the entire request path pipeline so that filtering and filesystem resolution agree.
   • Include case-sensitivity assumptions in security testing of file-serving configurations, especially across heterogeneous operating systems.
   • Maintain defense-in-depth so that no single path-based rule is the only barrier protecting sensitive data.

References

• NVD — CVE-2026-92700: https://nvd.nist.gov/vuln/detail/CVE-2026-92700
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• Caddy project repository and release notes: https://github.com/caddyserver/caddy
• Caddy documentation (static file server / hide configuration): https://caddyserver.com/docs/
• FIRST.org EPSS (not yet scored at time of writing): https://www.first.org/epss/

No CISA KEV listing, no public proof-of-concept, no exploit code, no Nuclei template, and no confirmed in-the-wild exploitation or attributed threat actor campaign were identified for CVE-2026-92700 at the time of writing.