Caddy's fileHidden function relies on case‑sensitive filepath.Match to enforce hide rules. In releases 2.11.3 and earlier, this strict case checking allows files that match a hidden pattern only in a different case to slip through, making files intended to remain hidden accessible to attackers. The vulnerability can lead to unintended disclosure of sensitive configuration or application files, compromising confidentiality and potentially aiding further attacks.

Caddy server platform, version 2.11.3 and earlier.

The CVSS score of 6.3 indicates a moderate severity flaw, and although no EPSS score is currently available, the lack of a KEV listing suggests it is not a actively exploited vulnerability at present. The likely attack vector is remote, through an HTTP request that targets a hidden file under a case‑variant path. Exploitation requires that the filesystem is case‑insensitive or that the server undergoes mixed‑case path resolution, which is common on Windows or non‑standard mount options. An attacker who can read the exposed file may gain sensitive information that could assist in privilege escalation or further compromise.