Configuration Weakness in Caddy Server with Potential Data Disclosure Risk

CVE-2026-77281

What is CVE-2026-77281?

Caddy Server, an extensible platform that utilizes TLS by default, suffers from configuration-dependent weaknesses in versions 2.11.3 and earlier. Specifically, the Rewrite.Rewrite() function in the rewrite module is vulnerable to an attack in which an attacker can exploit the URI rewrite mechanism. If a rewrite URI ends with a literal question mark, it may allow attacker-controlled replacement bytes, leading to unauthorized data disclosure through environment or request-variable placeholders. Furthermore, when the file provider is registered, this vulnerability could potentially expose readable files by injecting file placeholders. Users are encouraged to upgrade to version 2.11.4 or later to mitigate these risks.

References