Caddy vulnerabilities
3 known CVE vulnerabilities in Caddy, translated and rated.
- CVE-2026-52846Medium
Caddy before version 2.11.4 has a vulnerability in the stripHTML template function that cannot reliably remove all HTML tags from input strings. Malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output.
- CVE-2026-52845High
Caddy before version 2.11.4 has a vulnerability in the forward_auth copy_headers mechanism that allows a remote client to bypass identity header deletion and inject its own header into CGI/PHP-FastCGI. The issue arises from a difference in HTTP header normalization (replacing hyphens with underscores) between Caddy and PHP/FastCGI.
- CVE-2026-52844High
Caddy before version 2.11.4 on Windows incorrectly handles path separators in path matchers, allowing bypass of access controls to protected directories. An unauthenticated remote attacker can access protected resources.