Executive brief
Caddy is an extensible web server platform that handles HTTPS and request routing. In version 2.11.3 and earlier, a flaw in the URI rewrite handler allows attackers to inject malicious placeholders into query strings, potentially exposing sensitive environment variables, internal request data, or readable files on the server when certain configurations are used.
Technical details
The vulnerability is a placeholder re-expansion flaw in the rewrite handler (modules/caddyhttp/rewrite/rewrite.go). When a rewrite URI template ends with a literal question mark and contains a placeholder that expands to client-controlled bytes (e.g. {http.request.header.X-Fwd}), those bytes flow into buildQueryString() which performs a second placeholder expansion pass. An attacker can inject placeholder syntax such as {env.SECRET} or {file./path} to disclose environment variables, files, or internal request variables. The attack requires specific rewrite configuration and is network-reachable without authentication. The fix, released in version 2.11.4, escapes curly braces in injected query strings to prevent re-expansion.
Affected products
- Caddy Caddy 2.11.3 and earlier
Timeline
- 2026-09-17: disclosed
- 2026-05-26: patched: Fix merged in version 2.11.4