CVE-2026-52846: CWE-116: Improper Encoding or Escaping of Output in caddyserver caddy
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
AI Analysis
Technical Summary
CVE-2026-52846 affects Caddy server versions before 2.11.4. The stripHTML template function does not properly sanitize input strings containing malformed HTML tags, such as <<>img src=x onerror=alert()>. This improper encoding or escaping of output (CWE-116) can allow unsafe HTML content to be rendered, leading to client-side XSS vulnerabilities when untrusted strings are rendered without proper safety measures. The issue is resolved in Caddy 2.11.4.
Potential Impact
The vulnerability allows an attacker to bypass the stripHTML function's tag-stripping logic with malformed HTML, potentially injecting malicious scripts into web pages rendered by Caddy. This can lead to client-side cross-site scripting (XSS), which may result in information disclosure or execution of arbitrary scripts in the context of the victim's browser. The CVSS score is 4.2 (medium severity), reflecting limited impact and the requirement for user interaction.
Mitigation Recommendations
Upgrade Caddy to version 2.11.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Users should ensure that untrusted input is not rendered unsafely and apply the official patch promptly.
CVE-2026-52846: CWE-116: Improper Encoding or Escaping of Output in caddyserver caddy
Description
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
CVSS v3.1
Score 4.2medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-52846 affects Caddy server versions before 2.11.4. The stripHTML template function does not properly sanitize input strings containing malformed HTML tags, such as <<>img src=x onerror=alert()>. This improper encoding or escaping of output (CWE-116) can allow unsafe HTML content to be rendered, leading to client-side XSS vulnerabilities when untrusted strings are rendered without proper safety measures. The issue is resolved in Caddy 2.11.4.
Potential Impact
The vulnerability allows an attacker to bypass the stripHTML function's tag-stripping logic with malformed HTML, potentially injecting malicious scripts into web pages rendered by Caddy. This can lead to client-side cross-site scripting (XSS), which may result in information disclosure or execution of arbitrary scripts in the context of the victim's browser. The CVSS score is 4.2 (medium severity), reflecting limited impact and the requirement for user interaction.
Mitigation Recommendations
Upgrade Caddy to version 2.11.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Users should ensure that untrusted input is not rendered unsafely and apply the official patch promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T18:41:27.724Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3acbe4eed863c81e6c9a57
Added to database: 06/23/2026, 18:09:40 UTC
Last enriched: 06/30/2026, 23:12:14 UTC
Last updated: 08/04/2026, 12:46:13 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.