---
id: "CVE-2026-77281"
kind: "vulnerability"
aliases: ["CVE-2026-77281", "GHSA-j8px-rmrx-76h9", "GO-2026-6512"]
title: "Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy"
severity: "medium"
cvss: 6.5
epss: 0.00491
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/caddyserver/caddy/v2", "fixed": ["2.11.4"], "affected": "< 2.11.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["caddy", "go", "reverse-proxy", "runtime", "self-hosted"]
not_affected_if: ["no-file-provider", "no-rewrite-uri-ending-in-question-mark"]
published_at: "2026-09-17T21:17:37+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:09+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6512", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77281", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77281", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Caddy 2.11.3 and earlier re-expands attacker-supplied text as placeholders when a rewrite URI ends in a literal question mark. An attacker can use this to read environment variables and request variables, and with the file provider enabled, to read files the Caddy process can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/caddyserver/caddy/v2 affected < 2.11.4 fixed 2.11.4

## How to check

Run caddy version and check whether it is below 2.11.4. Search your Caddyfile or JSON config for rewrite directives whose URI ends in '?'. Check whether the file provider is registered.

## Fix

Upgrade Caddy to 2.11.4 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6512
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77281
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77281

## From the sources

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The  issue is fixed in version 2.11.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_