{"id":"CVE-2026-77281","kind":"vulnerability","aliases":["CVE-2026-77281","GHSA-j8px-rmrx-76h9","GO-2026-6512"],"related":[],"title":"Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy","description":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The  issue is fixed in version 2.11.4.","summary":"Caddy 2.11.3 and earlier re-expands attacker-supplied text as placeholders when a rewrite URI ends in a literal question mark. An attacker can use this to read environment variables and request variables, and with the file provider enabled, to read files the Caddy process can access.","severity":"medium","cvss":6.5,"epss":0.00491,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/caddyserver/caddy/v2","fixed":["2.11.4"],"affected":"< 2.11.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["caddy","go","reverse-proxy","runtime","self-hosted"],"not_affected_if":["no-file-provider","no-rewrite-uri-ending-in-question-mark"],"how_to_check":"Run caddy version and check whether it is below 2.11.4. Search your Caddyfile or JSON config for rewrite directives whose URI ends in '?'. Check whether the file provider is registered.","fix":"Upgrade Caddy to 2.11.4 or later.","status":"open","published_at":"2026-09-17T21:17:37+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:09+00:00","updated_at":"2026-10-23T21:46:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:46:09Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Caddy to 2.11.4 or later.","reach":"internet","impact":"medium","summary":"Caddy 2.11.3 and earlier re-expands attacker-supplied text as placeholders when a rewrite URI ends in a literal question mark. An attacker can use this to read environment variables and request variables, and with the file provider enabled, to read files the Caddy process can access.","category":"runtime","who_cares":["caddy","go","self-hosted","reverse-proxy"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Leaks environment variables and readable server files via injected placeholders.","analyst_note":"","how_to_check":"Run caddy version and check whether it is below 2.11.4. Search your Caddyfile or JSON config for rewrite directives whose URI ends in '?'. Check whether the file provider is registered.","needs_analyst":false,"not_affected_if":["no-rewrite-uri-ending-in-question-mark","no-file-provider"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000899,"input_tokens":3032,"output_tokens":1191,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A,21A '-6512':19A '-77281':11A,22A '/caddyserver/caddy':8A '/caddyserver/caddy/v2':25A '2.11.3':36B,97C '2.11.4':170C '76h9':16A 'access':83B 'affect':105C 'allow':138C,156C 'attack':43B,59B,117C 'attacker-control':116C 'attacker-suppli':42B 'buildquerystr':122C 'byte':120C 'caddi':26B,35B,80B,84C 'configur':102C 'configuration-depend':101C 'control':118C 'cve':9A,20A 'data':148C 'default':94C 'depend':103C 'disclos':147C,161C 'earlier':38B,99C 'enabl':75B 'end':52B,132C 'environ':65B,140C 'expand':41B 'expans':127C 'extens':87C 'file':73B,78B,152C,158C,163C 'fix':167C 'ghsa':13A 'ghsa-j8px-rmrx-76h9':12A 'github.com':7A,24A 'github.com/caddyserver/caddy':6A 'github.com/caddyserver/caddy/v2':23A 'go':17A,27B 'handler':107C 'handler/placeholder':3A 'host':34B 'inject':139C,157C 'issu':165C 'j8px':14A 'layer':4A,110C 'liter':55B,135C 'mark':57B,137C 'modules/caddyhttp/rewrite/rewrite.go':112C 'pass':115C 'placehold':47B,109C,126C,145C,159C 'platform':89C 'process':81B 'provid':74B,153C 'proxi':30B 'question':56B,136C 're':40B 're-expand':39B 'read':64B,77B 'readabl':162C 'regist':155C 'replac':119C 'request':68B,143C 'request-vari':142C 'revers':29B 'reverse-proxi':28B 'rewrit':50B,130C 'rewrite.rewrite':113C 'rmrx':15A 'runtim':31B 'second':125C 'self':33B 'self-host':32B 'server':88C 'suppli':44B 'text':45B 'three':100C 'tls':92C 'uri':51B,131C 'use':61B,91C 'variabl':66B,69B,144C 'version':96C,169C 'vulner':1A 'weak':104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-17T21:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6512","url":"https://pkg.go.dev/vuln/GO-2026-6512","severity":null,"published_at":"2026-10-01T20:23:42+00:00","modified_at":"2026-10-01T20:23:42+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77281","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77281","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77281","severity":null,"published_at":"2026-09-17T21:17:37+00:00","modified_at":"2026-09-24T21:16:28+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}