In caddyserver caddy versions up to 2.11.3, the staticfiles.go module's fileHidden() function performs case-sensitive filepath.Match checks. This leads to improper handling of case sensitivity (CWE-178), allowing attackers to bypass hide rules on case-insensitive filesystems or in environments with mixed-case paths. As a result, files that should be hidden may be exposed unintentionally.

The vulnerability may allow unintended exposure of files that were meant to be hidden by the server's configuration. This could lead to information disclosure if sensitive files are accessible due to case mismatch bypasses. There is no indication of privilege escalation, remote code execution, or other impacts beyond potential file exposure.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with file hiding configurations on case-insensitive filesystems and consider additional access controls to protect sensitive files.