CVE-2026-77281: Caddy: rewrite placeholder re-expansion
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Caddyto a version that resolves this vulnerability.Fixed in 2.11.4
Event History
Frequently Asked Questions
Which deployments are exposed to data disclosure?
Affected deployments use Caddy 2.11.3 or earlier and have a configuration in which a rewrite URI ends with a literal question mark and attacker-controlled replacement bytes can reach that rewrite. Exposure to readable file contents additionally requires the file provider to be registered.
What can an unauthenticated attacker obtain?
An attacker can inject placeholders that are expanded a second time, potentially disclosing environment variables or request variables. If the file provider is registered, injected file placeholders can disclose files readable by the Caddy process.
What is the remediation?
Upgrade Caddy to version 2.11.4, which fixes the issue. Until upgrading, review rewrite rules for URIs ending in a literal question mark and prevent untrusted input from being used as replacement bytes in those rules.