CVSS 4.0
5.5 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:PCVE-2026-30852
Medium (5.5) in caddyserver caddy. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/caddyserver/caddy/v2/modules/caddyhttp 2.11.2.
Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-74, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- caddyserver:caddy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m2w3-8f23-hxxf | Go | github.com/caddyserver/caddy/v2/modules/caddyhttp | >=2.7.5 <2.11.2 | 2.11.2 |
| GO-2026-4644 | Go | github.com/caddyserver/caddy/v2 | >=2.7.5 <2.11.2 | 2.11.2 |