{"uuid": "0f413242-b103-4bdd-912c-d1908077cfbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77281", "type": "seen", "source": "https://gist.github.com/alon710/1cc5e28018afd10dbf96bffc511ba50d", "content": "# CVE-2026-77281: CVE-2026-77281: Rewrite Placeholder Re-expansion Vulnerability in Caddy Web Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77281\n\n## Summary\nA critical double-evaluation vulnerability exists in the rewrite module of the Caddy web server. Under specific configurations where a rewrite directive ends with a literal question mark and processes client-controlled headers, the system performs a secondary expansion pass. This allows attackers to evaluate arbitrary internal placeholder variables, leading to unauthorized disclosure of sensitive environment variables and system files.\n\n## TL;DR\nCaddy's rewrite engine double-evaluates placeholder expressions when rewrite directives end with a literal question mark. Remote attackers can exploit this by injecting placeholder tokens via HTTP headers to extract internal environment variables or read local system files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.5\n- **Exploit Status**: PoC-stage (Regression tests)\n- **Affected Component**: Caddy rewrite module\n- **Impact**: Information Disclosure (Environment variables, local files)\n\n## Affected Systems\n\n- Caddy Web Server\n- **Caddy**: >= 2.8.3, < 2.11.4 (Fixed in: `2.11.4`)\n\n## Mitigation\n\n- Upgrade Caddy to version v2.11.4 or higher to apply proper sanitization of evaluated queries.\n- Modify rewrite rules to avoid passing client-controlled variables directly into rewrites ending with a literal question mark.\n- Implement WAF rules to filter out double curly brace character sequences within HTTP headers.\n\n**Remediation Steps:**\n1. Identify all deployed instances of Caddy currently running versions between v2.8.3 and v2.11.3.\n2. Download the v2.11.4 release binary or rebuild using 'xcaddy' with the latest stable branch.\n3. Review active Caddyfiles for patterns matching 'rewrite * /path/{http.request.header.Header-Name}?' and restructure them to use explicit query parameters.\n4. Deploy WAF rules to drop requests with malicious template injections.\n\n## References\n\n- [https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9](https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-77281](https://nvd.nist.gov/vuln/detail/CVE-2026-77281)\n- [https://github.com/caddyserver/caddy/releases/tag/v2.11.4](https://github.com/caddyserver/caddy/releases/tag/v2.11.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77281) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T15:31:48.742625Z"}