StackRadarChart IndexLive demo

CVE-2026-52844

High

Advisory

Published 16 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 36; of 17,781 indexed, latest versions
Container images: 30; deployed by those charts
Fix available: 1 of 2; affected packages

Caddy: Windows `file_server` path authorization bypass via encoded backslash

Carried by container images the latest versions of 36 of 17,781 indexed charts deploy, on 30 images.

Affected package	Affected versions	Fixed in	Images
github.com/caddyserver/caddy/v2golang	v2.2.0, v2.4.0, v2.4.2, v2.4.5+13 more	2.11.4	25
github.com/caddyserver/caddygolang	v1.0.3, v1.0.5	no fix listed	5

OSV records: GHSA-qrp7-cvwr-j2c6
Also known as: GO-2026-5595

Charts affected

36 by stars

Chart

Latest

Affected images

Radar Score

chaos-meshchaos-mesh

1 of 4 See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	github.com/caddyserver/caddy@v1.0.5	no fix listed

Open the chart page →

6,342

mercuremercure

1 of 1 See more

mercure mercure 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
dunglas/mercure :v0.24.0	80fcb704a741	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4

Open the chart page →

1,409

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

17,263

caddy-ingress-controllercaddy-ingress

1 of 1 See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

1,884

convertigoconvertigo

1 of 5 See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
baserow/baserow :1.30.1	df0c42eb67e8	github.com/caddyserver/caddy/v2@v2.7.6	2.11.4

Open the chart page →

17,404

kubeviouskubevious

1 of 7 See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
kubevious/ui :1.2.1	6233e84bdd59	github.com/caddyserver/caddy/v2@v2.6.1	2.11.4

Open the chart page →

14,204

maintenancecodewithemad

1 of 1 See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.9-alpine	b4e3952384eb	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4

Open the chart page →

1,469

gboxgbox

1 of 2 See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
gboxproxy/gbox :v1.0.6	3a9f4a711d5c	github.com/caddyserver/caddy/v2@v2.5.0	2.11.4

Open the chart page →

2,521

filebrowsergeek-cookbook

1 of 1 See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.18.0	4fcd47af573c	github.com/caddyserver/caddy@v1.0.3	no fix listed

Open the chart page →

3,474

headscale-uiheadscale-ui

1 of 1 See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

1,476

kubebrowsekubebrowse

1 of 5 See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

4,141

wordpress-helmwordpress-helm

1 of 4 See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

8,217

baserowblackbird-cloud

1 of 6 See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

10,145

caddycaddy

1 of 1 See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.11.2-alpine	834468128c76	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4

Open the chart page →

1,677

catalyst-agentscatalyst-agents

1 of 18 See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	github.com/caddyserver/caddy@v1.0.5	no fix listed

Open the chart page →

15,027

mercurecloudnativeapp

1 of 1 See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
dunglas/mercure :v0	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

1,098

parrot-mirroremmas-charts

1 of 1 See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4

Open the chart page →

2,237

chaos-meshethereum-helm-charts

1 of 4 See more

chaos-mesh ethereum-helm-charts 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.6	78dc63bc5b89	github.com/caddyserver/caddy@v1.0.5	no fix listed

Open the chart page →

12,127

supportpalevilgn0me

1 of 1 See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4

Open the chart page →

20,933

searxgeek-cookbook

1 of 4 See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.2.0-alpine	7367adca165f	github.com/caddyserver/caddy/v2@v2.2.0	2.11.4

Open the chart page →

7,470

vikunjageek-cookbook

1 of 4 See more

vikunja geek-cookbook 6.2.0

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.4.2-alpine	fbc51bcf1ab0	github.com/caddyserver/caddy/v2@v2.4.2	2.11.4

Open the chart page →

6,893

castopodhelmforge

1 of 3 See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
castopod/castopod :1.15.5	4e4f0440520f	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

9,342

discount-bandithelmforge

1 of 3 See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

29,817

pimcorehelmforge

1 of 6 See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
dunglas/mercure :v0.24.2	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

3,156

ryothelmforge

1 of 2 See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4

Open the chart page →

6,012

chaos-meshkubeblocks

1 of 4 See more

chaos-mesh kubeblocks 2.7.2

1 of the 4 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.6	78dc63bc5b89	github.com/caddyserver/caddy@v1.0.5	no fix listed

Open the chart page →

13,497

op-scim-bridgelifen

1 of 2 See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4

Open the chart page →

2,777

op-scim-bridgelifen-charts

1 of 2 See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4

Open the chart page →

2,777

otlp-gatewayloafoe

1 of 2 See more

otlp-gateway loafoe 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	github.com/caddyserver/caddy/v2@v2.8.4	2.11.4

Open the chart page →

2,155

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4

Open the chart page →

2,101

novosgamarcusrepo

1 of 2 See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
novosga/novosga :latest	34b9acbe6e51	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4

Open the chart page →

3,706

1 of 1 See more

coredns moikot 1.13.3

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
coredns/coredns :1.7.0	73ca82b4ce82	github.com/caddyserver/caddy@v1.0.5	no fix listed

Open the chart page →

2,547

gitlab-proxyopslevel

1 of 1 See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.6	60fb54d36b4b	github.com/caddyserver/caddy/v2@v2.6.4	2.11.4

Open the chart page →

1,872

caddysagikazarmark

1 of 1 See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
library/caddy :2.4.5	874405536b3e	github.com/caddyserver/caddy/v2@v2.4.5	2.11.4

Open the chart page →

2,960

tfy-cloudflaredtruefoundry

1 of 2 See more

tfy-cloudflared truefoundry 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	github.com/caddyserver/caddy/v2@v2.6.3	2.11.4

Open the chart page →

2,015

filebrowserwenerme

1 of 1 See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52844.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.13.0	c5d0a75a0041	github.com/caddyserver/caddy@v1.0.3	no fix listed

Open the chart page →

3,174

Container images carrying it

30 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4	3
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4	2
dunglas/mercure :v0 :v0.24.2	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4	2
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	github.com/caddyserver/caddy@v1.0.5	no fix listed	2
ghcr.io/chaos-mesh/chaos-coredns :v0.2.6	78dc63bc5b89	github.com/caddyserver/caddy@v1.0.5	no fix listed	2
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4	1
baserow/baserow :1.30.1	df0c42eb67e8	github.com/caddyserver/caddy/v2@v2.7.6	2.11.4	1
castopod/castopod :1.15.5	4e4f0440520f	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
coredns/coredns :1.7.0	73ca82b4ce82	github.com/caddyserver/caddy@v1.0.5	no fix listed	1
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
dunglas/mercure :v0.24.0	80fcb704a741	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4	1
filebrowser/filebrowser :v2.18.0	4fcd47af573c	github.com/caddyserver/caddy@v1.0.3	no fix listed	1
filebrowser/filebrowser :v2.13.0	c5d0a75a0041	github.com/caddyserver/caddy@v1.0.3	no fix listed	1
gboxproxy/gbox :v1.0.6	3a9f4a711d5c	github.com/caddyserver/caddy/v2@v2.5.0	2.11.4	1
kubevious/ui :1.2.1	6233e84bdd59	github.com/caddyserver/caddy/v2@v2.6.1	2.11.4	1
library/caddy :2.6	60fb54d36b4b	github.com/caddyserver/caddy/v2@v2.6.4	2.11.4	1
library/caddy :2.2.0-alpine	7367adca165f	github.com/caddyserver/caddy/v2@v2.2.0	2.11.4	1
library/caddy :2.11.2-alpine	834468128c76	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4	1
library/caddy :2.4.5	874405536b3e	github.com/caddyserver/caddy/v2@v2.4.5	2.11.4	1
library/caddy :2.9-alpine	b4e3952384eb	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4	1
library/caddy :2.4.2-alpine	fbc51bcf1ab0	github.com/caddyserver/caddy/v2@v2.4.2	2.11.4	1
novosga/novosga :latest	34b9acbe6e51	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4	1
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4	1
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	github.com/caddyserver/caddy/v2@v2.8.4	2.11.4	1
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4	1
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	github.com/caddyserver/caddy/v2@v2.6.3	2.11.4	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4	1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4	1