CVE-2026-52846
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
- Affected products
- Caddy
- Caddyserver Caddy
- < 2.11.4
- Fix
- Available
- CVSS 3.1
- 4.2 MEDIUM
- EPSS
- 0.2% (7th percentile)
- Weakness
- CWE-116
- NVD status
- Analyzed
- Published
- 2026-06-23
CVE-2026-52846 at NVD
No indexed exploits for CVE-2026-52846 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-52846 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.