4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52846

CVE-2026-52846: Caddy: stripHTML template function bypass

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52846

CVE-2026-52846:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/caddyserver/caddy/v2	go	<= 2.11.3	2.11.4
github.com/caddyserver/caddy	go	<= 1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the funcStripHTML function within Caddy's template engine. The function's purpose is to remove HTML tags from a string. The original implementation relied on a simple state machine to identify tags. This implementation had a flaw in its handling of malformed HTML, specifically nested opening angle brackets (<). When presented with an input like <<>..., the parser would incorrectly interpret the second < as a "false start" to a new tag, write the first < to the output buffer, and then a subsequent > would reset the parser's state. This allowed the remainder of the malicious tag (e.g., an <img> tag with an onerror attribute) to be written to the output, resulting in a cross-site scripting (XSS) vulnerability if the output is rendered as HTML. The patch addresses this by replacing the flawed state machine with a more robust depth-counting mechanism. This new approach correctly tracks the nesting level of tags and handles quoted attributes, preventing the bypass.

Vulnerable functions

TemplateContext.funcStripHTML

modules/caddyhttp/templates/tplcontext.go

The original implementation of `funcStripHTML` used a state machine that could be bypassed with malformed HTML, such as `<<>img src=x onerror=alert()>`. The logic for handling a nested '<' (a "false start") would write the initial '<' to the buffer and reset the tag start position. A subsequent '>' would then close the tag parsing state, causing the rest of the malicious HTML tag to be written to the output, leading to a potential XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.