Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-52846Caddy: stripHTML template function bypass

Medium 4.2

In plain English

A medium-severity security flaw in caddy from caddyserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	caddy	2.6.2-5+deb12u1	DEBIAN-CVE-2026-52846
Debian:13	caddy	2.6.2-12+deb13u1	DEBIAN-CVE-2026-52846
Debian:14	caddy	2.11.4-1	DEBIAN-CVE-2026-52846
Go	github.com/caddyserver/caddy	no fix listed	GHSA-vcc4-2c75-vc9v
Go	github.com/caddyserver/caddy/v2	2.11.4	GO-2026-5660
Go	github.com/caddyserver/caddy/v2	2.11.4	GHSA-vcc4-2c75-vc9v
Ubuntu:25.10	caddy	no fix listed	UBUNTU-CVE-2026-52846
Ubuntu:26.10	caddy	no fix listed	UBUNTU-CVE-2026-52846

Affected products (as reported)

Vendor	Product	Versions
caddyserver	caddy	< 2.11.4

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v x_refsource_CONFIRM