Executive brief
Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy
Affected products
- Go github.com/caddyserver/caddy/v2
- Go github.com/caddyserver/caddy/v2/modules/caddyhttp
Junglewise Threat Intelligence
CVE-2026-30852: GO-2026-4644 - Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy
CVE-2026-30852 · Severity: medium · CVSS 4 · Published 2026-03-10
Technologies: github.com/caddyserver/caddy/v2 (Go). Vendors: Go.
Related threats
- Caddy placeholder re-expansion in URI rewrite
- GO-2026-5408 - Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
- GO-2026-5730 - Caddy Fix Bypass in github.com/caddyserver/caddy
- Caddyserver Caddy XSS bypass in stripHTML template function
- Caddy authentication bypass via FastCGI header normalization collision