CVE-2026-52846: Caddy Server stripHTML XSS Vulnerability

CVE-2026-52846 Overview

CVE-2026-52846 is a medium-severity vulnerability in Caddy, an extensible server platform that uses Transport Layer Security (TLS) by default. The stripHTML template function fails to remove all HyperText Markup Language (HTML) tags from input strings before version 2.11.4. Malformed HTML payloads such as <<>img src=x onerror=alert()> bypass the tag-stripping logic. When the sanitized output is later rendered as HTML, attackers can trigger client-side cross-site scripting (XSS). The issue is fixed in Caddy 2.11.4 and is classified under [CWE-116] Improper Encoding or Escaping of Output.

Critical Impact
Attackers can deliver crafted HTML that survives stripHTML sanitization and executes JavaScript in victim browsers when rendered downstream.

Affected Products

Caddy server versions prior to 2.11.4
Applications using the Caddy stripHTML template function on untrusted input
Downstream services that render stripHTML output as HTML without additional escaping

Discovery Timeline

2026-06-23 - CVE-2026-52846 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52846

Vulnerability Analysis

The vulnerability resides in Caddy's stripHTML template helper, which is intended to remove HTML tags from arbitrary input. The function's parser does not correctly handle nested or malformed angle brackets. A payload like <<>img src=x onerror=alert()> confuses the tag boundary detection, leaving an executable <img> tag in the output. Developers who trust stripHTML as a sanitizer and then emit the result into an HTML context inherit a stored or reflected XSS sink. Exploitation requires user interaction, because a victim must visit a page that renders the unsanitized output. Attack complexity is high since the attacker depends on a downstream template that renders stripHTML output as raw HTML rather than escaped text.

Root Cause

The root cause is incomplete output encoding logic in stripHTML. The parser treats certain malformed sequences as non-tags, so it leaves portions of attacker-controlled markup intact. This contradicts the implicit security contract that callers assume when using a tag-stripping helper, mapping to [CWE-116].

Attack Vector

An attacker submits crafted strings through any field that flows into a Caddy template using stripHTML. Vectors include comment fields, profile data, query parameters, or any user-controlled value processed by the template engine. When the rendered page reaches a victim's browser, the surviving onerror or other event-handler attribute fires, executing attacker-controlled JavaScript in the victim's session.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-vcc4-2c75-vc9v for technical details.

Detection Methods for CVE-2026-52846

Indicators of Compromise

Inbound HTTP requests containing nested or malformed tag sequences such as <<>img, <<script, or stacked angle brackets with event-handler attributes like onerror=, onload=, or onclick=.
Outbound HTML responses containing <img, <svg, or <iframe fragments in fields that should have been sanitized.
Browser Content Security Policy (CSP) violation reports tied to inline script execution on pages that consume stripHTML output.

Detection Strategies

Inspect Caddy access logs for request bodies and query strings matching regular expressions that target stacked < characters followed by event-handler attributes.
Add web application firewall (WAF) rules that flag double-open-bracket patterns and HTML event handlers in user-supplied fields.
Review templates for direct emission of stripHTML output into HTML contexts without additional escaping or contextual encoders.

Monitoring Recommendations

Track the installed Caddy version across the fleet and alert when any host runs a release below 2.11.4.
Forward Caddy logs and browser CSP reports into a centralized analytics platform to correlate suspicious input with downstream script execution.
Monitor for unexpected outbound DNS or HTTP callbacks from end-user browsers that could indicate successful XSS execution.

How to Mitigate CVE-2026-52846

Immediate Actions Required

Upgrade Caddy to version 2.11.4 or later on all servers that use template rendering.
Audit every template that calls stripHTML and confirm whether the output is rendered as HTML or as text.
Treat stripHTML output as untrusted and apply contextual HTML escaping before emission.

Patch Information

The Caddy maintainers fixed the parser in version 2.11.4. Review the Caddy GitHub Security Advisory GHSA-vcc4-2c75-vc9v for the patch details and upgrade instructions.

Workarounds

Replace stripHTML with a dedicated HTML sanitizer library that uses an allowlist of safe tags and attributes.
Apply standard template auto-escaping by emitting user content as text rather than raw HTML.
Deploy a strict CSP that disables inline scripts and event handlers to reduce XSS impact while upgrades roll out.

bash

# Verify Caddy version and upgrade
caddy version
# Upgrade to a fixed release (2.11.4 or later) using your package manager
# Example for a binary install:
curl -fsSL https://github.com/caddyserver/caddy/releases/download/v2.11.4/caddy_2.11.4_linux_amd64.tar.gz -o caddy.tgz
tar -xzf caddy.tgz caddy && sudo install caddy /usr/local/bin/caddy
sudo systemctl restart caddy
caddy version