Bug 2491908 (CVE-2026-52846)
| Summary: | CVE-2026-52846 github.com/caddyserver/caddy: Caddy: Client-side Cross-Site Scripting (XSS) due to incomplete HTML tag stripping | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abuckta, aprice, cmah, crizzo, dkuc, eshamard, gtanzill, jbuscemi, jdobes, jmitchel, jsamir, jsherril, jvasik, kaycoth, kgaikwad, kshier, mstipich, oezr, orabin, rblanco, rexwhite, rochandr, stcannon, sthirugn, teagle, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Caddy, an extensible server platform. The `stripHTML` template function, intended to remove HTML tags from input, fails to reliably process certain malformed HTML. This oversight allows dangerous content to remain in the output, which, if subsequently rendered as HTML, can lead to client-side Cross-Site Scripting (XSS). A remote attacker could exploit this by providing specially crafted input, potentially executing malicious scripts in a user's browser.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2499696, 2499697 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-23 19:02:50 UTC
|