Caddyserver Caddy expression language injection in vars_regexp

Executive brief

A vulnerability in the Caddy web server allows attackers to steal sensitive information by sending specially crafted web requests. By exploiting a flaw in how Caddy processes internal variables, an attacker can force the server to reveal environment variables (like AWS keys or database passwords) or read local system files. This could lead to a full compromise of the server's credentials and sensitive data.

Technical details

A bypass of the fix for CVE-2026-30852 exists in Caddy's 'vars_regexp' and 'MatchVarsRE' components within 'modules/caddyhttp/vars.go'. The original fix only prevented double expansion when variable keys were placeholders; however, literal key names remain unprotected and undergo a second round of expansion. An attacker can provide a request header containing Caddy placeholders (e.g., {env.SECRET} or {file./etc/passwd}) which are resolved during the second pass. This allows for the disclosure of sensitive environment variables, system information, or local files (up to 1MB) through reflected response headers or forwarded backend requests.

Affected products

• Caddyserver Caddy 2.11.0 - 2.11.2

Timeline

• 2026-05-13: disclosed: Advisory published to caddyserver/caddy repository
• 2026-05-19: advisory: GitHub Advisory published

References

• https://api.github.com/users/everping
• https://github.com/everping
• https://api.github.com/users/everping/gists%7B/gist_id%7D
• https://api.github.com/users/everping/repos
• https://avatars.githubusercontent.com/u/5586195?v=4
• https://api.github.com/users/everping/events%7B/privacy%7D