CVE-2026-77281: CWE-94: Improper Control of Generation of Code ('Code Injection') in caddyserver caddy
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
AI Analysis
Technical Summary
CVE-2026-77281 affects caddyserver caddy up to version 2.11.3. The vulnerability arises in the modules/caddyhttp/rewrite/rewrite.go component, specifically in the Rewrite.Rewrite() function. When a rewrite URI ends with a literal question mark, the function can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion. This allows injection of environment or request-variable placeholders, potentially disclosing sensitive data. Additionally, if the file provider module is registered, injected file placeholders can disclose readable files. The vulnerability is addressed in version 2.11.4.
Potential Impact
An attacker can exploit this vulnerability to disclose sensitive environment variables, request variables, or readable files on the server. The impact is limited to information disclosure (confidentiality loss) with no direct integrity or availability impact reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact.
Mitigation Recommendations
Upgrade caddyserver caddy to version 2.11.4 or later, where this vulnerability is fixed. No other mitigations are specified or required once the official fix is applied.
CVE-2026-77281: CWE-94: Improper Control of Generation of Code ('Code Injection') in caddyserver caddy
Description
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
CVSS v3.1
Score 6.5medium
Affected software
caddyserver
caddy
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77281 affects caddyserver caddy up to version 2.11.3. The vulnerability arises in the modules/caddyhttp/rewrite/rewrite.go component, specifically in the Rewrite.Rewrite() function. When a rewrite URI ends with a literal question mark, the function can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion. This allows injection of environment or request-variable placeholders, potentially disclosing sensitive data. Additionally, if the file provider module is registered, injected file placeholders can disclose readable files. The vulnerability is addressed in version 2.11.4.
Potential Impact
An attacker can exploit this vulnerability to disclose sensitive environment variables, request variables, or readable files on the server. The impact is limited to information disclosure (confidentiality loss) with no direct integrity or availability impact reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact.
Mitigation Recommendations
Upgrade caddyserver caddy to version 2.11.4 or later, where this vulnerability is fixed. No other mitigations are specified or required once the official fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:14:21.331Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac58d755bf5e2cf5ef74a8
Added to database: 09/17/2026, 21:17:11 UTC
Last enriched: 09/17/2026, 21:32:18 UTC
Last updated: 09/18/2026, 03:37:32 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.