CVE-2026-52846

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.4

Description Caddy is an extensible server platform that uses TLS by default. The stripHTML template function, specifically within the funcStripHTML() function, cannot reliably remove all HTML tags from input strings. Certain malformed HTML can bypass the tag-stripping logic, potentially leaving dangerous content in the output. If this output is later rendered as HTML, it may allow client-side Cross-Site Scripting (XSS), where an attacker can execute arbitrary JavaScript in the user's browser.

Recommendations Update Caddy to version 2.11.4. As a temporary workaround, restrict the use of the stripHTML function for processing untrusted strings until the update is applied.