Most recent entries from all

fkie_cve-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.

GHSA-j8px-rmrx-76h9 — Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Affected: Go: github.com/caddyserver/caddy/v2

# Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer

**Tested against:** `caddy:2.11.3` (official Docker image, SHA verified at runtime) **Reproduction environment:** Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 10 host, isolated containers, no network egress required for any of the exploits

This advisory bundles three independent issues discovered together during a source review of the placeholder/replacer layer. Each issue has been reproduced end-to-end against the unmodified `caddy:2.11.3` image with the minimal Caddyfile that the documentation suggests for the affected feature.

---

## Issue 1: Rewrite handler — placeholder double-expansion enables env var / file disclosure

**File:** `modules/caddyhttp/rewrite/rewrite.go:215-249` and `buildQueryString` at `327` **Class:** CWE-94 (Code Injection), same bug class as CVE-2026-30852 (`vars_regexp`) **Severity:** Low (requires operator config with trailing `?` in rewrite URI)

### Root cause

When the operator's `rewrite` URI template: 1. Contains a placeholder that resolves to request data (e.g. `{http.request.header.X-Foo}`), AND 2. Ends with a literal `?` (with empty query side)

…then the bytes produced by the **first** Replacer pass (which include attacker-controlled header values) are fed through `buildQueryString`, which runs a **second** Replacer pass and resolves any placeholders the attacker injected.

```go // rewrite.go (abridged) newPath = repl.ReplaceAll(path, "") // pass 1 — h…

UBUNTU-CVE-2026-77281

Affected: Ubuntu:Pro:24.04:LTS: caddy, Ubuntu:Pro:26.04:LTS: caddy