Bug 2499696

Summary: CVE-2026-52846 caddy: Caddy: Client-side Cross-Site Scripting (XSS) due to incomplete HTML tag stripping [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Jon Weiser <jweiser>
Component: caddyAssignee: Carl George 🤠 <carlwgeorge>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: carlwgeorge, drist029ity, go-sig, ngompa13
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["9f942824-aad6-4ac0-a6b3-016543e09b9c"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2491908    

Description Jon Weiser 2026-07-13 14:46:13 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
Comment 1 drist ity 2026-07-20 05:46:42 UTC 
which is intended to remove HTML tags but can be bypassed using specially crafted malformed HTML input. If such untrusted input is processed and later displayed as HTML, an attacker could inject malicious scripts that run in a user's browser. https://www.peryourhealth.us.com