The vulnerability resides in Caddy's file matcher path sanitization routine, which fails to escape backslashes in glob characters. This flaw falls under CWE-20 and allows crafted requests to bypass the intended directory boundaries. As a result, an attacker could request files outside the served directory, potentially accessing sensitive data.

Affects users running Caddy versions older than 2.11.1 under configurations that enable the file matcher with glob patterns. The issue is resolved in release 2.11.1; therefore any instance using that version or later is no longer impacted.

The CVSS score of 6.9 denotes moderate severity, and the EPSS score (<1%) indicates a low prevalence of exploitation. The vulnerability is not listed in KEV. Attackers could exploit this remotely by sending HTTP requests with backslashes in the URL path to achieve unauthorized file access, provided the server allows such requests and there is no additional authentication barrier. Effectiveness depends on the server's configuration and exposure to external traffic.