Caddy, a TLS‑enabled server platform, suffers a path‑scoping flaw on Windows before version 2.11.4. When a client requests /private\secret.txt, the path matcher interprets the encoded backslash as a literal backslash and treats the request as outside /private/*. However, the file_server module resolves the same path to the local file private\secret.txt. Because path‑based authentication or deny rules apply only to the matcher’s view, an unauthenticated attacker can craft such a request to read files that should be protected. The flaw originates from a mismatch between path normalization (CWE‑22) and authorization enforcement (CWE‑284).

Caddy servers running on Windows with the file_server module prior to 2.11.4 are affected. The vulnerability exists only on Windows installations, as Linux path semantics do not exhibit the same backslash handling issue. Systems that deploy Caddy with path‑based authentication or deny rules for directories such as /private/* are at risk.

The CVSS score of 7.5 indicates a high severity vulnerability. It is not listed in CISA KEV. The EPSS score is not available, so an exact exploitation probability cannot be quantified, but the attack is remote and requires only a crafted HTTP request, with no privileged credentials or user interaction. An attacker can send such a request from outside the network, bypassing path‑based authentication or deny rules and accessing files that should be protected. Because the flaw exists in a widely used module, the likelihood of exploitation is moderate to high for exposed Caddy instances.