CVE-2026-77281: CVE-2026-77281: Rewrite Placeholder Re-expansion Vulnerability in Caddy Web Server

#security #cve #cybersecurity

CVE-2026-77281: Rewrite Placeholder Re-expansion Vulnerability in Caddy Web Server

Vulnerability ID: CVE-2026-77281
CVSS Score: 6.5
Published: 2026-09-18

A critical double-evaluation vulnerability exists in the rewrite module of the Caddy web server. Under specific configurations where a rewrite directive ends with a literal question mark and processes client-controlled headers, the system performs a secondary expansion pass. This allows attackers to evaluate arbitrary internal placeholder variables, leading to unauthorized disclosure of sensitive environment variables and system files.

TL;DR

Caddy's rewrite engine double-evaluates placeholder expressions when rewrite directives end with a literal question mark. Remote attackers can exploit this by injecting placeholder tokens via HTTP headers to extract internal environment variables or read local system files.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-94
Attack Vector: Network (AV:N)
CVSS Base Score: 6.5
Exploit Status: PoC-stage (Regression tests)
Affected Component: Caddy rewrite module
Impact: Information Disclosure (Environment variables, local files)

Affected Systems

Caddy Web Server
Caddy: >= 2.8.3, < 2.11.4 (Fixed in: 2.11.4)

Code Analysis

Commit: 176b043

Fix double-expansion vulnerability in rewrite module by escaping braces in the injected query string

--- a/modules/caddyhttp/rewrite/rewrite.go
+++ b/modules/caddyhttp/rewrite/rewrite.go
@@ -101,3 +101,7 @@
            newPath, injectedQuery = before, after
            if query == "" {
+               injectedQuery = strings.ReplaceAll(injectedQuery, "{", "%7B")
+               injectedQuery = strings.ReplaceAll(injectedQuery, "}", "%7D")
                query = injectedQuery
            }

Exploit Details

GitHub: Official regression test cases proving the double placeholder expansion payload behavior.

Mitigation Strategies

Upgrade Caddy to version v2.11.4 or higher to apply proper sanitization of evaluated queries.
Modify rewrite rules to avoid passing client-controlled variables directly into rewrites ending with a literal question mark.
Implement WAF rules to filter out double curly brace character sequences within HTTP headers.

Remediation Steps:

Identify all deployed instances of Caddy currently running versions between v2.8.3 and v2.11.3.
Download the v2.11.4 release binary or rebuild using 'xcaddy' with the latest stable branch.
Review active Caddyfiles for patterns matching 'rewrite * /path/{http.request.header.Header-Name}?' and restructure them to use explicit query parameters.
Deploy WAF rules to drop requests with malicious template injections.

References

Read the full report for CVE-2026-77281 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community