CVE-2026-52846

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

• CWE-116

• https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9vExploit, Third Party Advisory
• https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9vExploit, Third Party Advisory

Published

Jun 23, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52840Easy!Appointments is a self hosted appointment scheduler. In…2.7
• CVE-2026-52841Easy!Appointments is a self hosted appointment scheduler. In…3.1
• CVE-2026-52842Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52843Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52844Caddy is an extensible server platform that uses TLS by defa…7.5
• CVE-2026-52845Caddy is an extensible server platform that uses TLS by defa…8.1
• CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-52855Wings is the server control plane for Pterodactyl, a free, o…9.9
• CVE-2026-52856Wings is the server control plane for Pterodactyl, a free, o…7.5
• CVE-2026-52857Wings is the server control plane for Pterodactyl, a free, o…5.5
• CVE-2026-52858Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2026-52859Vim is an open source, command line text editor. Prior to ve…8.2