Caddy CVE-2026-77281

Requires a Caddy (<=2.11.3) rewrite handler whose configured URI ends with a literal '?' AND embeds an attacker-controllable placeholder such as {http.request.header.*} - this is a non-default operator-written configuration. When those conditions hold, an unauthenticated remote attacker (CVSS PR:N/UI:N) can inject {env.*} or {http.request.*} placeholders to disclose environment/request variables; disclosure of arbitrary readable files (e.g. via {file./etc/passwd}) additionally requires the Caddy file placeholder provider to be registered. Limiting factor: deployments without a rewrite rule matching this exact pattern are not exploitable, so despite the network/unauthenticated vector the practical exposure is narrow.

This is a moderate, configuration-gated information-disclosure flaw rather than the RCE its input tags claim. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5) marks it network-reachable and unauthenticated, which is accurate for the attack surface, but the AC:L is optimistic: exploitation requires a specific non-default Caddy config (a rewrite rule whose URI ends with a literal '?' and embeds an attacker-controlled placeholder such as a request header), so real-world attack complexity is higher than the score implies. No EPSS score, SSVC decision, or POC/KEV signal was supplied - exploitation status is 'no public exploit identified at time of analysis', though the fix commit ships regression tests (GHSA-j8px-rmrx-76h9) that concretely demonstrate the double-expansion mechanism, effectively lowering the bar to build a working exploit. The vendor also assigned A:L, which appears unjustified - the described impact is data disclosure (env vars, request variables, and, when the file provider is registered, arbitrary readable files) with no availability or integrity effect. Net: a real but niche issue whose severity hinges entirely on whether a given Caddy deployment uses the vulnerable rewrite pattern; not a widespread mass-exploitation priority, but arbitrary readable-file disclosure (e.g. secrets, /etc/passwd) on affected configs makes it a genuine confidentiality risk worth patching.

An operator runs Caddy with a rewrite rule like URI '/serve/{http.request.header.X-Fwd}?' (trailing literal '?'). An unauthenticated attacker sends an HTTP request with a header value such as 'foo?path={file./etc/passwd}'; the first placeholder pass expands the header into the path, the trailing '?' causes the bytes to be split and fed to buildQueryString, which runs a second placeholder pass that evaluates the injected {file...} or {env...} placeholder and reflects the secret. No public weaponized exploit is identified, but the fixed commit's regression tests demonstrate the exact injection strings.