Vulnerability Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Caddyserver | Caddy | < 2.11.4 |
Related Weaknesses (CWE)
References
- https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9vExploitThird Party Advisory
- https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9vExploitThird Party Advisory
FAQ
What is CVE-2026-52846?
CVE-2026-52846 is a vulnerability with a CVSS score of 4.2 (MEDIUM). Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, s...
How severe is CVE-2026-52846?
CVE-2026-52846 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-52846?
Check the references section above for vendor advisories and patch information. Affected products include: Caddyserver Caddy.