ETK-2026-3427Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3427",
  "cve_id": null,
  "display_id": "ETK-2026-3427",
  "ghsa_id": "GHSA-r766-rf9f-588h",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Host-controlled path traversal in Caddy",
  "summary": "Caddy deployments that construct a document root from the request host are affected. An unauthenticated remote client may cause files outside the intended site tree to be served, and may execute PHP files when PHP handling is configured; explicitly named-host sites are not affected.",
  "mitigation": "Upgrade github.com/caddyserver/caddy/v2 to version 2.11.8. Until upgraded, stop using request-host-derived document roots and restrict sites to explicit host names.",
  "vendor": "go",
  "product": "go:github.com/caddyserver/caddy/v2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.11.7"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.11.8"
      ],
      "package_name": "github.com/caddyserver/caddy/v2",
      "purl": "pkg:golang/github.com/caddyserver/caddy/v2"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.06578305,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-04T00:59:13+00:00",
      "days": -0.11547623168981482,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T03:45:30.195410+00:00",
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-r766-rf9f-588h"
    },
    "trigger_signal": {
      "at": "2026-11-04T00:59:13+00:00",
      "days": -0.11547623168981482,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T03:45:30.195410+00:00",
      "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-r766-rf9f-588h"
    }
  }
}