CVE-2026-52846

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v	Exploit Third Party Advisory
https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*

History

29 Jun 2026, 19:08

Type	Values Removed	Values Added
References	~~() https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v -~~	() https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v - Exploit, Third Party Advisory
First Time		Caddyserver Caddyserver caddy
CPE		cpe:2.3:a:caddyserver:caddy::::::::

25 Jun 2026, 13:16

Type	Values Removed	Values Added
References	~~() https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v -~~	() https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v -

23 Jun 2026, 18:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-23 18:18

Updated : 2026-06-29 19:08

NVD link : CVE-2026-52846

Mitre link : CVE-2026-52846

CVE.ORG link : CVE-2026-52846

JSON object : View

Products Affected

caddyserver

caddy

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-52846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52846", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T12:42:12.083385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "caddyserver", "product": "caddy", "versions": [{"status": "affected", "version": "< 2.11.4"}]}]}], "published": "2026-06-23T18:18:05.400", "references": [{"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy\u2019s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4."}], "lastModified": "2026-06-29T19:08:52.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CC2FFA3-3F35-452A-A0B6-C1B66C0C73E6", "versionEndExcluding": "2.11.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}