{"id":"EUVD-2026-82474","enisaUuid":"25fca081-c3d3-33d4-879c-5f11bbd1da0f","description":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The  issue is fixed in version 2.11.4.","datePublished":"Sep 17, 2026, 9:04:58 PM","dateUpdated":"Sep 18, 2026, 2:43:34 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9\nhttps://github.com/caddyserver/caddy/pull/7761\nhttps://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb\nhttps://github.com/caddyserver/caddy/releases/tag/v2.11.4\n","aliases":"CVE-2026-77281\nGHSA-j8px-rmrx-76h9\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"56d5e71f-9c7c-395e-8bce-0b44987508a8","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"enisaIdVendor":[{"id":"ddb42ebd-410b-35e7-8447-e8aa75fd8587","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"39a7e056-715d-3cee-97ae-5140e53b4ac0","vulnerability":{"id":"GHSA-j8px-rmrx-76h9","description":"Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass","datePublished":"Sep 18, 2026, 1:09:27 PM","dateUpdated":"Sep 18, 2026, 1:09:27 PM","baseScore":0.0,"references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77281\nhttps://github.com/caddyserver/caddy/pull/7761\nhttps://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb\nhttps://github.com/caddyserver/caddy\nhttps://github.com/caddyserver/caddy/releases/tag/v2.11.4\n","enisa_id":"EUVD-2026-82474\n","aliases":"CVE-2026-77281\nGHSA-j8px-rmrx-76h9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cafadc18-7208-36c0-b643-aecda1d60661","vulnerability":{"id":"CVE-2026-77281","description":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The  issue is fixed in version 2.11.4.","datePublished":"Sep 17, 2026, 9:04:58 PM","dateUpdated":"Sep 18, 2026, 2:43:34 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9\nhttps://github.com/caddyserver/caddy/pull/7761\nhttps://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb\nhttps://github.com/caddyserver/caddy/releases/tag/v2.11.4\n","enisa_id":"EUVD-2026-82474\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Oct 30, 2026, 7:15:53 AM","vulnerabilityProduct":[{"id":"455301db-e92f-3abf-9328-ad0b1f66144a","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"\u003c 2.11.4"}],"vulnerabilityVendor":[{"id":"58993638-8993-3291-8b27-6631949c0131","vendor":{"name":"caddyserver"}}]}}],"enisaIdAdvisory":[]}