CVE-2026-52846: Caddy stripHTML XSS Bypass (CWE-116)

Technical summary

The stripHTML function in Caddy fails to properly handle edge-case HTML constructs, particularly malformed opening tags with nested angle brackets. The bypass technique exploits a gap in the tag-matching logic where non-standard sequences are not fully consumed before content is returned. When an attacker controls input to stripHTML and the output is subsequently rendered in an HTML context (e.g., within a Caddy template that outputs to a web page without further escaping), the malformed tag can evade removal, preserving event handler attributes that execute in the victim's browser. This is classified as an Improper Input Validation (CWE-116) issue. The vulnerability was patched in version 2.11.4 with improved tag-stripping logic that correctly handles malformed constructs.

Business impact

For organizations using Caddy as a web server or gateway, the risk is moderate but depends heavily on deployment context. If Caddy is used in a configuration where the stripHTML function processes user-supplied data that is later served to end users, an attacker could inject XSS payloads that steal session tokens, redirect users, or perform actions on their behalf. The impact is primarily on confidentiality and integrity of client-side data; availability is not affected. Organizations relying on stripHTML for security should treat this as a trust boundary breach and prioritize patching. Those who do not use stripHTML or who handle HTML sanitization at a separate layer face lower risk.

Affected systems

Caddy versions prior to 2.11.4 are vulnerable. This includes all 2.11.x releases up to and including 2.11.3, as well as earlier major versions (2.10, 2.9, etc.). Caddy is typically deployed as a reverse proxy, API gateway, or file server, often in cloud-native and containerized environments. Organizations using Caddy in production should verify their running version and apply the 2.11.4 update. Custom Caddy builds or distributions bundled with other software should be evaluated against their vendor's release timelines.

Exploitability

Exploitation requires two conditions: (1) the attacker must be able to supply input that is processed by stripHTML, and (2) the resulting output must be rendered as HTML to an end user without additional escaping. The attack vector is network-based and requires user interaction (a victim must view the malicious content in a browser), reflected in the CVSS score of 4.2 (Medium). Complexity is rated as High because the attacker must craft a specific malformed HTML pattern and ensure it reaches an unsafe rendering context. This is not a trivial one-click exploit; it requires understanding the application's use of stripHTML and its output sanitization practices. No public exploit code has been disclosed as of the advisory date.

Remediation

Upgrade Caddy to version 2.11.4 or later. Operators should audit their Caddy configuration and template files to identify any reliance on stripHTML as a primary security control. If stripHTML is used to sanitize untrusted user input before rendering, ensure output is additionally escaped or use a dedicated, well-tested HTML sanitization library (e.g., bluemonday for Go, or similar). Consider implementing Content Security Policy (CSP) headers as a defense-in-depth measure to mitigate client-side injection risks.

Patch guidance

Update Caddy to version 2.11.4 or later. This is available from the official Caddy project releases. If using Caddy through a package manager (apt, yum, Homebrew, etc.), check for available updates and apply them. If running Caddy in a container, update the base image or Caddy binary and redeploy. Verify the upgrade by running `caddy version` and confirming the output shows 2.11.4 or higher. After patching, restart Caddy to activate the fixed binary.

Detection guidance

Look for stripHTML function calls in Caddy configuration files (Caddyfiles) and custom Caddy plugins or Go code. Monitor for any template blocks that use stripHTML and then output the result to HTML contexts without escaping. If you cannot easily identify stripHTML usage, test your Caddy instance with a payload like <<>img src=x onerror=alert(test)> through user input fields and inspect the response to see if the malformed tag is removed. Additionally, review web server logs for unusual HTML patterns in query strings or POST bodies. Security scanning tools that test for XSS may trigger on this vulnerability if your application accepts the malformed payload.

Why prioritize this

This vulnerability should be prioritized based on your use of stripHTML and your application's trust boundary design. If Caddy is internet-facing and accepts untrusted user input that is processed by stripHTML and rendered to other users, this is a clear XSS vector and should be patched immediately. If stripHTML is used only internally or as a secondary defense layer behind a dedicated sanitizer, the risk is lower. The CVSS score of 4.2 reflects the requirement for user interaction and limited scope, but the actual risk in your environment depends on whether the two exploitation conditions are met. Review quickly; patch within one release cycle if affected.

Risk score, explained

The CVSS 3.1 score of 4.2 (Medium severity) reflects: Network-based attack vector (AV:N); High complexity because a specific malformed HTML construct must reach an unsafe rendering context (AC:H); no privilege required (PR:N); user interaction needed—the victim must view the page with the injected content (UI:R); unchanged scope (S:U); limited confidentiality and integrity impact on the client's session or data (C:L, I:L); and no availability impact (A:N). The score appropriately downgrades from High because the vulnerability requires two implementation decisions (use of stripHTML + unsafe output) and user interaction. In a real-world XSS scenario, the user impact could be severe, but the CVSS baseline assumes a less-critical context.

Frequently asked questions