CVE-2026-52846 Caddy: stripHTML template function bypass
Attackers can bypass HTML stripping to inject malicious scripts, leading to client-side XSS when untrusted data is rendered.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52846?
CVE-2026-52846 is a medium-severity cross-site scripting vulnerability in caddyserver caddy, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
Weakness: CWE-116
Which versions are affected by CVE-2026-52846?
5 open source packages ship an affected version, including github.com/caddyserver/caddy/v2 and github.com/caddyserver/caddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy/v2 Go | All versions | 2.11.4 |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
github.com/caddyserver/caddy Go | All versions to 1.0.5 | None |
Products include Caddyserver Caddy.
How do I fix CVE-2026-52846?
Upgrade github.com/caddyserver/caddy/v2 to 2.11.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-52846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52846 exists.
Other vulnerabilities in caddyserver caddy
- CVE-2018-21246 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Sources
Also known as CLEANSTART-2026-UL03599, DEBIAN-CVE-2026-52846, GHSA-vcc4-2c75-vc9v, GO-2026-5660, MINI-p8cr-c9wg-wrmw, MINI-qvjv-hmf9-m25g and 1 more.