Medium severity4.2GHSA Advisory· Published Jun 23, 2026· Updated Jun 29, 2026
CVE-2026-52846
CVE-2026-52846
Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/caddyserver/caddy/v2Go | < 2.11.4 | 2.11.4 |
github.com/caddyserver/caddyGo | <= 1.0.5 | — |
Affected products
3cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*range: <2.11.4
- (no CPE)range: <= 1.0.5
- osv-coordsRange: < 0.0.20260727T201416-160000.1.1
Patches
Vulnerability mechanics
References
2- github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9vnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-vcc4-2c75-vc9vghsaADVISORY
News mentions
0No linked articles in our index yet.