---
id: CVE-2026-52846
title: 'Caddy: stripHTML template function bypass'
summary: 'Caddy: stripHTML template function bypass'
severity: medium
cvss: 4.2
cwe:
- CWE-116
vendor: caddyserver
product: github.com/caddyserver/caddy/v2
ecosystem: go
affected:
- github.com/caddyserver/caddy/v2 <= 2.11.3
- github.com/caddyserver/caddy <= 1.0.5
patched:
- github.com/caddyserver/caddy/v2 2.11.4
published: '2026-06-16'
updated: '2026-06-16'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vcc4-2c75-vc9v'
references:
- url: >-
https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v
- url: 'https://github.com/advisories/GHSA-vcc4-2c75-vc9v'
tags:
- ghsa
- go
epss: 0.00189
epssPercentile: 0.08741
ingestedAt: '2026-06-29T14:31:47.680Z'
---
## Overview
### Summary
Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as `<<>img src=x onerror=alert()>`, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely.
---
### Details
The vulnerability originates from `funcStripHTML` in:
[caddy/caddy/caddyhttp/templates/tplcontext.go](https://github.com/caddyserver/caddy/blob/77e9ce7404c4a76853e101a9f5687a929ee56654/modules/caddyhttp/templates/tplcontext.go)
```go
func (TemplateContext) funcStripHTML(s string) string {
var buf bytes.Buffer
var inTag, inQuotes bool
var tagStart int
for i, ch := range s {
if inTag {
if ch == '>' && !inQuotes {
inTag = false
} else if ch == '<' && !inQuotes {
// false start
buf.WriteString(s[tagStart:i])
tagStart = i
} else if ch == '"' {
inQuotes = !inQuotes
}
continue
}
if ch == '<' {
inTag = true
tagStart = i
continue
}
buf.WriteRune(ch)
}
if inTag {
// false start
buf.WriteString(s[tagStart:])
}
return buf.String()
}
```
### POC
Caddyfile setup
```
:8080 {
root * ./site
file_server
templates
}
```
Template file (index.html)
```html
StripHTML Bypass Test
{{ stripHTML "<<>img src=x onerror=alert('XSS')>" }}
```
The payload exploits the false start branch to smuggle a literal < back into the output, then uses the following > to terminate the parser’s tag state, leaving a valid ![]()
tag behind.
Tested in v2.11.3
### Impact
Malformed HTML can bypass stripHTML, potentially allowing arbitrary HTML or JavaScript to be rendered if the output is used unsafely, leading to client-side XSS.
### AI Disclosure
AI assisted in writing the report description; however, the discovery of the issue has been done manually.
## Affected packages
- `github.com/caddyserver/caddy/v2 <= 2.11.3`
- `github.com/caddyserver/caddy <= 1.0.5`
## Remediation
Upgrade to a patched release:
- `github.com/caddyserver/caddy/v2 2.11.4`