CVE-2026-77281

MEDIUM 6.5

Caddy: rewrite placeholder re-expansion

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.

CWE	CWE-94 CWE-178 CWE-770
Vendor	caddyserver
Product	caddy
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for caddyserver caddy

Be the first to know when new medium vulnerabilities affecting caddyserver caddy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Affected Versions

caddyserver / caddy

< 2.11.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9 github.com: https://github.com/caddyserver/caddy/pull/7761 github.com: https://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb github.com: https://github.com/caddyserver/caddy/releases/tag/v2.11.4