CVE-2026-77281 in Caddy
Summary
by MITRE • 09/18/2026
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
Caddy serves as an extensible server platform that prioritizes security by enabling Transport Layer Security by default for all connections. However, a critical configuration-dependent weakness was identified within the handler and placeholder expansion layers of versions up to 2.11.3. This vulnerability stems from how the system processes URI rewrites when specific structural conditions are met in the request path. The core technical flaw resides in the rewrite module, specifically within the Rewrite.Rewrite function found in modules/caddyhttp/rewrite/rewrite.go. Under normal operation, Caddy expands placeholders to substitute dynamic values into configuration directives or response bodies. However, a logic error allows for an unintended second round of placeholder expansion under specific circumstances involving query string construction.
The vulnerability is triggered when a rewrite URI directive ends with a literal question mark character. In such configurations, the Rewrite.Rewrite function invokes buildQueryString to process replacement bytes that may contain attacker-controlled input. This invocation leads to a secondary phase of placeholder expansion where previously processed or injected placeholders are interpreted again as active directives rather than static data. Consequently, if an attacker can control parts of the URI path or query parameters used in these rewrite rules, they can inject environment variables or request-variable placeholders into this second expansion cycle. The system then resolves these placeholders against the server's current runtime context, effectively allowing the disclosure of sensitive internal state information that was not intended to be exposed through HTTP responses.
The operational impact of this flaw is significant depending on the modules enabled in the Caddy instance. When standard environment or request-variable placeholders are exploited, an attacker can disclose data such as system environment variables, server configuration details, and other metadata associated with the running process. This information leakage aids attackers in mapping the internal infrastructure and identifying further attack vectors. Furthermore, if the file module is registered within the Caddy configuration, the vulnerability escalates to allow for Local File Inclusion attacks. By injecting specific file-related placeholders during this second expansion phase, an attacker can force the server to read and disclose the contents of any readable files on the underlying operating system. This capability effectively bypasses standard access controls by leveraging the server's own privileges to expose sensitive configuration files, source code, or other private data stored in accessible directories.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and more specifically CWE-915 Improvement of Incorrectly Controlled Modification of Dynamically-Determined Object Attributes due to the improper handling of dynamically constructed inputs leading to unintended object state changes or data exposure. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1087 Account Discovery as it allows enumeration of system accounts and environment variables through web application interactions. It also relates to T1530 Data from Local System which covers the exfiltration of files from local storage via exploited software vulnerabilities. The root cause lies in insufficient validation or sanitization of placeholder strings before they undergo recursive expansion, failing to distinguish between literal characters meant for display and active placeholders intended for resolution.
To mitigate this vulnerability, organizations running Caddy must immediately upgrade to version 2.11.4 or later where the logic error in buildQueryString has been corrected to prevent unintended secondary expansions. Administrators should audit their configuration files for any rewrite rules that end with a literal question mark and ensure they are updated after upgrading. Additionally, it is recommended to follow the principle of least privilege by restricting file module permissions so that Caddy cannot read sensitive system files unless absolutely necessary. Regular security assessments and static code analysis focused on placeholder expansion logic can help identify similar patterns in custom modules or extensions before deployment. Maintaining up-to-date software versions remains the most effective defense against such configuration-dependent flaws that exploit complex parsing behaviors within web server platforms.