CVE-2026-52846 | Caddy is an extensible server platform that uses TLS by defa… | CVSS 4.2 MEDIUM

Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

Metadata

CVE ID: CVE-2026-52846
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-08 18:41 UTC
Published: 2026-06-23 17:47 UTC
Last updated: 2026-06-23 17:47 UTC
Primary CWE: CWE-116
CWE-116: Improper Encoding or Escaping of Output
Vendor / Product: caddyserver / caddy
Sources: cve.org · NVD

Severity & Metrics

4.2 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products (1)

Vendor	Product	Platform	Versions
caddyserver	caddy	—	< 2.11.4

Weakness (CWE)

CWE	Source	Description
CWE-116	cna	CWE-116: Improper Encoding or Escaping of Output

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.2	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References (1)

https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v