GHSA-g7pc-pc7g-h8jh: Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

Caddy's path matcher is supposed to be case-insensitive, but when a match pattern contains percent-escape sequences (encoded characters like %2F for a slash), it compares the request path without lowercasing it, allowing attackers to bypass access controls by changing letter casing (for example, requesting /ADMIN%2Fpanel instead of /admin%2Fpanel).