5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30852

CVE-2026-30852: Caddy: vars_regexp double-expands user input, leaking env vars and files

Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30852

CVE-2026-30852:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/caddyserver/caddy/v2/modules/caddyhttp	go	>= 2.7.5, <= 2.11.1	2.11.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the vars_regexp matcher in Caddy, specifically in the MatchVarsRE.Match function in modules/caddyhttp/vars.go. The root cause is a double-expansion of user-controlled input. When a user provides a value containing a Caddy placeholder, such as {env.DATABASE_URL} or {file./etc/passwd}, in a request element that is processed by vars_regexp, the server evaluates it twice. The first expansion resolves the request variable to the user-provided string, and the second, unintended expansion evaluates the placeholders within that string. This allows an attacker to craft requests that cause the server to leak sensitive information from environment variables, local files, or system information. The vulnerability was introduced in pull request #5408, which added the line valExpanded := repl.ReplaceAll(varStr, "") to the Match function. This change was intended to fix an issue with placeholder keys but inadvertently introduced the double-expansion vulnerability. The fix is to remove the second expansion by using the raw variable string directly.

Vulnerable functions

caddyhttp.MatchVarsRE.Match

modules/caddyhttp/vars.go

The function `MatchVarsRE.Match` is vulnerable to information disclosure. The vulnerability exists because the function performs a double expansion of user-controlled input. When a request is made with a header like `X-Input: {env.SECRET_API_KEY}`, the `vars_regexp` matcher first resolves the placeholder `{http.request.header.X-Input}` to its value, which is `{env.SECRET_API_KEY}`. Then, the function calls `repl.ReplaceAll` on this value, which is the second expansion. This causes the server to replace `{env.SECRET_API_KEY}` with the actual secret, which is then returned in the response, leaking sensitive information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.