Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/caddyserver/caddy/v2/modules/caddyhttp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5GoPublished

    Caddy's vars_regexp double-expands user input, leaking env vars and files

    CVE-2026-30852 · GHSA-m2w3-8f23-hxxf

    Affected
    • Go github.com/caddyserver/caddy/v2/modules/caddyhttp >= 2.7.5, <= 2.11.1
    Fixed in
    2.11.2· Vendor fix available
    Issue
    The varsregexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When varsregexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASEURL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. headerregexp does NOT do this — it passes header values straight to Match(). So this is a code-level inconsistency, not intended behavior. Details The bug is at modules/caddyhttp/vars.go, line 337 in MatchVarsRE.MatchWithError(): When the key is a placeholder like {http.request.header.X-Input}, repl.Get() resolves it to the raw header value (first expansion, line 318). Then repl.ReplaceAll() runs on that value again (second expansion, line 337), which evaluates any {env.}, {file.}, {system.} placeholders the…

    Recommended action: Upgrade to 2.11.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →