GITHUB.COM/CADDYSERVER/CADDY/V2 · GHSA-jf74-f69g-hcj9 · Runtime
FIX → 2.11.8
When neither XDG_DATA_HOME nor HOME is set, Caddy stores its certificates and private keys in a relative ./caddy folder under the working directory. A file server rooted at that directory then serves those keys to anonymous clients, letting them impersonate the site or mint trusted certificates.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that start Caddy without HOME and XDG_DATA_HOME set and serve their working directory, through caddy file-server or a file_server rooted at '.'. Containers, systemd units without a home directory and CI runners are the usual cases. Deployments that set HOME or XDG_DATA_HOME, or serve a dedicated static directory, are not exposed.
Not affected if home-directory-set, managed-hosting, static-dir-root
Who cares caddy, containers, go, self-hosted
echo $HOME $XDG_DATA_HOME in the environment that starts Caddy; both empty means exposure is possible.caddy folder with certificates or local CA keys.file_server or caddy file-server has a root of . or the working directory.When neither XDG_DATA_HOME nor HOME is set, caddy.AppDataDir() returns ./caddy, so certificates, private keys and the local CA keys live under the working directory. caddy file-server and any file_server rooted at . serve them to anonymous clients when started from that directory.
AppDataDir() (storage.go) falls back to the relative path ./caddy when no home directory can be found (some containers, systemd units without a home, CI runners). caddy file-server serves the working directory by default (--root defaults to the current directory), and so does a file_server whose root is . FrankenPHP's command has the same default root.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.11.8
github.com/caddyserver/caddy/v2 fixed in 2.11.8; affected <= 2.11.7..php-serverFix: FileServer.Provision adds the absolute form of the data directory to Hide when AppDataDir() is relative. This covers the Caddyfile, JSON configs and the file-server command, the same way the Caddyfile is already hidden. Patch: public PR from dunglas:fileserver-hide-relative-data-dir.
Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-JBWWW7FF.
$ cd /srv/site && env -u HOME -u XDG_DATA_HOME caddy file-server --domain localhost
$ curl -k https://localhost/caddy/certificates/local/localhost/localhost.key
-----BEGIN EC PRIVATE KEY-----
The same happens with this Caddyfile, run from /srv/site without HOME:
localhost {
root .
file_server
}
Anonymous clients download TLS private keys and the local CA's root and intermediate keys, which lets them impersonate the site or mint certificates trusted by clients that installed the local CA. Only deployments without HOME and XDG_DATA_HOME that serve their working directory are affected.