Executive brief
Caddy is a web server platform used to host websites and manage encrypted traffic. A flaw in its HTML-stripping feature allows specially crafted text to bypass security filters, potentially allowing malicious scripts to run in a user's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A vulnerability exists in Caddy's 'stripHTML' template function due to improper handling of malformed HTML tags. The 'funcStripHTML' implementation in 'tplcontext.go' contains logic for handling 'false starts' (nested or unexpected '<' characters) that can be exploited to smuggle literal HTML tags into the output. Specifically, a payload like '<<>img src=x onerror=alert()>' triggers a branch that writes a literal '<' back to the buffer while prematurely terminating the parser's tag state. This allows an attacker to bypass the intended sanitization and execute arbitrary JavaScript (XSS) if the output is rendered in a browser. The issue is fixed in version 2.11.4.
Affected products
- Caddyserver Caddy < 2.11.4
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published by maintainers
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix released in version 2.11.4