medium CVSS 4.2 EPSS 0.25%

CVE-2026-52846·Caddy vulnerability

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

Severity
medium
Software
Caddy
Fixed in
2.11.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.25% — higher than 15% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 2.11.4

Fixed in: 2.11.4

How to fix this CVE

Update Caddy to version 2.11.4 or later to patch the stripHTML template function's HTML tag-stripping vulnerability. If you use Caddy's template functions to sanitize user input for HTML rendering, immediately verify your deployment and apply the update. This fix ensures that malformed HTML sequences cannot bypass tag removal and reach the browser as executable content.

sudo dnf update caddy || sudo dnf install caddy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests containing double-angle-bracket sequences (e.g., <<>img, <<svg, <<script) followed by event handlers (onerror=, onload=, onclick=) targeting endpoints that use stripHTML; log pattern: /<<[^>]*(?:img|svg|script)[^>]*(?:onerror|onload|onclick)=/i

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement a WAF rule to block HTTP requests containing malformed nested angle brackets followed by event handler attributes: deny if (regex match of '<<[^>]*(?:img|svg|script|iframe|object)[^>]*(?:onerror|onload|onclick|onmouseover)=' in request body). Additionally, enforce Content-Security-Policy (CSP) headers with script-src 'none' or 'self' on endpoints rendering user content.

How to check if you are affected

  1. Check installed Caddy version: caddy version
  2. Review Caddyfile for use of stripHTML template function: grep -r 'stripHTML' /etc/caddy/
  3. Identify routes that process untrusted input and render it as HTML: grep -r 'template\|stripHTML' /etc/caddy/Caddyfile*
  4. After upgrade, verify the new version: caddy version | grep -E '2\.1[1-9]\.|2\.[2-9]'
  5. Test stripHTML behavior with malformed input: echo '<<>img src=x onerror=alert()>' | caddy run (if running a test endpoint)

FAQ

What is CVE-2026-52846?

CVE-2026-52846 is a cross-site scripting (XSS) vulnerability in Caddy's stripHTML template function that fails to remove certain malformed HTML tags, such as <<>img src=x onerror=alert()>, allowing attackers to inject executable scripts if untrusted content is rendered in the browser.

Is CVE-2026-52846 being actively exploited?

No. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available.

What versions of Caddy are affected by CVE-2026-52846?

All Caddy versions prior to 2.11.4 are affected. This includes all 2.11.x releases up to 2.11.3 and all earlier major/minor versions.

How do I check if my server is vulnerable to CVE-2026-52846?

Run `caddy version` and check if the version number is below 2.11.4. If you see output like `v2.11.3` or earlier, your deployment is vulnerable. Additionally, review your Caddyfile for any stripHTML function usage with untrusted input sources.

Does Defensia detect CVE-2026-52846?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Caddy is installed on a monitored server, CVE-2026-52846 will appear in your dashboard with remediation steps.

Related Caddy CVEs

CVE-2026-27590CVSS 9.8Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.
CVE-2026-52845CVSS 8.1Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVE-2026-45135CVSS 8.1Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
CVE-2026-52844CVSS 7.5Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
CVE-2026-45692CVSS 5.4Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-52846. Free for 1 server.

Get started free