Caddy EUVD-2026-85515

Requires Caddy's file_server handler configured with a hide directive AND the files being served from a case-insensitive filesystem (Windows, default macOS/APFS) or a scenario where mixed-case path variants of the same file coexist. Exploitation is unauthenticated and remote, but the bypass does NOT apply on standard case-sensitive Linux filesystems (ext4/xfs) - which is the most common Caddy production platform - so this AT:P attack requirement significantly limits real-world exposure. Impact is limited to disclosure of files the operator intended to hide; no integrity or availability impact.

This is a genuine but modest-severity information disclosure issue, not a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L, score 6.3) indicates a network-reachable, unauthenticated flaw but with an attack requirement (AT:P) and only Low confidentiality impact and no integrity/availability impact - consistent with a hide-rule bypass that leaks file contents rather than granting code execution. The AT:P requirement is the key nuance: exploitation is gated on the underlying filesystem being case-insensitive (Windows/macOS default) or on mixed-case paths coexisting, so on typical Linux/ext4 production deployments the bypass generally does not apply. No EPSS score, no CISA KEV listing, and no working POC for THIS specific issue were provided (the reproduction code in the advisory demonstrates a DIFFERENT bundled vulnerability, the rewrite double-expansion CWE-94 issue, not the fileHidden bypass). Net: no public exploit identified for this issue at time of analysis and no evidence of active exploitation - treat as a low-to-medium remediation priority, prioritized higher only where Caddy serves files from a case-insensitive filesystem and relies on the hide directive to protect secrets such as .env or config files.

An operator runs Caddy's file_server with a hide directive (e.g. hiding .env or a config file) on a case-insensitive filesystem such as Windows or default macOS. A remote unauthenticated attacker requests the same file using a case variant (e.g. /.ENV or /Config.json), which does not match the case-sensitive filepath.Match hide check, and the server returns the intended-hidden file's contents. No POC for this specific issue is public; the advisory's reproduction code covers a separate bundled bug.