Caddy versions prior to 2.11.1 contain an error in the HTTP path request matcher: percent‑escaped segments are compared without case normalization. This flaw allows an attacker to alter the casing of a path in the request URL so that the server treats the request as matching a different route. The result is that path‑based routing logic and any access controls tied to that route can be bypassed, potentially granting unauthorized access to protected resources or services.

The vulnerability affects servers running Caddy server platform version 2.11.0 and earlier. The issue was addressed and fixed in release 2.11.1, as noted by the Caddy developers.

The flaw carries a CVSS score of 7.7 and an EPSS probability of less than 1 %, indicating a low probability of exploitation but still high impact if used. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP request containing a percent‑escaped path with altered casing; no elevated privileges or local access are required. The attack is therefore remote and can be executed simply by targeting the exposed HTTP interface.