Live › vulnerability › CVE-2026-77281
Go to dashboardCaddy 2.11.3 and earlier re-expands attacker-supplied text as placeholders when a rewrite URI ends in a literal question mark. An attacker can use this to read environment variables and request variables, and with the file provider enabled, to read files the Caddy process can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/caddyserver/caddy/v2 | go | < 2.11.4 | 2.11.4 |
2.11.4Upgrade Caddy to 2.11.4 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-77281")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.