{"id":"CVE-2022-29718","aliases":["GHSA-2927-hv3p-f3vp"],"title":"Open redirect in caddy","summary":"Open redirect in caddy","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"caddyserver","product":"github.com/caddyserver/caddy","ecosystem":"go","affected":["github.com/caddyserver/caddy < 2.5.0","github.com/caddyserver/caddy/v2 < 2.5.0"],"patched":["github.com/caddyserver/caddy 2.5.0","github.com/caddyserver/caddy/v2 2.5.0"],"published":"2022-06-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:43.627683998Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2927-hv3p-f3vp","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29718"},{"url":"https://github.com/caddyserver/caddy/pull/4499"},{"url":"https://github.com/caddyserver/caddy/pull/4499/commits/b23bdcf99cfbd09d50555a999a16468404789230"},{"url":"https://github.com/caddyserver/caddy"},{"url":"https://github.com/caddyserver/caddy/releases/tag/v2.5.0"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP2VIUT5IKA3OKM6YWA5LTLJ2GTEIH7C"}],"tags":["osv","go"],"epss":0.01034,"epssPercentile":0.62293,"ingestedAt":"2026-09-12T03:13:01.745Z","slug":"CVE-2022-29718","body":"## Overview\n\nCaddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.\n\n## Affected packages\n\n- `github.com/caddyserver/caddy < 2.5.0`\n- `github.com/caddyserver/caddy/v2 < 2.5.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/caddyserver/caddy 2.5.0`\n- `github.com/caddyserver/caddy/v2 2.5.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}