Cross-Site Scripting Risk in Caddy Server by Caddy Technologies

CVE-2026-52846

What is CVE-2026-52846?

Caddy Server, an extensible server platform that employs TLS by default, has a vulnerability in its stripHTML template function, which fails to reliably strip all HTML tags from user input. This issue is particularly notable with certain malformed HTML inputs, such as , that can successfully bypass the tag-stripping process. As a result, malicious content may remain in the output, potentially leading to client-side XSS attacks if untrusted strings are rendered without proper sanitization. Users are advised to update to version 2.11.4 or later to mitigate this risk.

References