CVE-2026-77281

Executive Summary

CVE-2026-77281 is a configuration-dependent input-injection vulnerability (CWE-94, Improper Control of Generation of Code / injection class) in Caddy, the popular open-source extensible web server platform that enables TLS by default. In Caddy 2.11.3 and earlier, the Rewrite.Rewrite() function in modules/caddyhttp/rewrite/rewrite.go can perform an unintended second placeholder expansion on attacker-controlled replacement bytes when a rewrite URI ends with a literal question mark. This allows an attacker to inject placeholders that disclose environment or request-variable data — and, when the file provider is registered, to disclose readable files via injected file placeholders. Caddy 2.11.4 resolves the flaw. CVSS v3.1 rates the issue 6.5 (Medium): network-exploitable, no privileges or user interaction required, with low confidentiality and low availability impact. No public PoC, exploit code, or Nuclei template exists at the time of writing, and CISA KEV status is negative — but exploitation is trivial to attempt against misconfigured rewrite rules, so prioritized patching is warranted for any Caddy front-end exposed to untrusted traffic.

Technical Analysis

Caddy is widely deployed as a reverse proxy and static-file/web server, frequently fronting application stacks due to its automatic HTTPS and Caddyfile-driven configuration. The vulnerability lives in the HTTP handler layer — specifically the rewrite module — which rewrites/redirects request URIs and then re-expands any placeholders present in the resulting bytes.

The NVD description identifies three configuration-dependent weaknesses in the handler and placeholder layer. The core defect: Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString, triggering a second placeholder expansion when a rewrite URI ends with a literal question mark (?). Caddy's placeholder engine ({env.*}, {http.request.*} request variables, file placeholders from the file provider, etc.) is designed to be evaluated once on trusted configuration input. Because the rewrite result is re-processed, bytes that the attacker supplied inside the rewritten URI can be interpreted as placeholders during the second pass — a classic "double evaluation" / template/injection flaw (CWE-94).

Attack surface: any Caddy deployment with a rewrite directive whose target URI can end in ? and whose resulting string is fed back into buildQueryString. Because the vuln is configuration-dependent, not every Caddy instance is exploitable; only those with compatible rewrite rules qualify.

Impact classes implied by the description:

1. Environment / request-variable disclosure — injected environment or request-variable placeholders ({env.VAR}, {http.request.*}) are expanded and their values can be disclosed to the attacker. This is the general case.
2. File disclosure — when the Caddy file provider is registered, injected file placeholders can disclose files the Caddy process can read. This is the higher-severity branch and justifies the C:L confidentiality subscore.

No integrity impact is scored, meaning the description does not suggest attacker-controlled writes; the availability impact (A:L) likely reflects denial-of-service potential via resource-consuming expansions rather than persistent destruction. Note: the description states three configuration-dependent weaknesses are involved but enumerates only these disclosure vectors; additional details beyond the supplied NVD text are not available and are not asserted here.

The root cause class is untrusted-input re-expansion: user data crossing into a directive-language interpreter (placeholder engine) a second time. This mirrors well-known injection patterns (e.g., SSTI, double URL-decoding) where input validated or interpreted once is misinterpreted because a second evaluation pass runs over data that should have been treated as opaque.

Exploitation Scenarios

No public PoC or exploit code is available. The chain below is derived strictly from the NVD description and is presented at the vulnerability-class level.

1. Reconnaissance / target identification. The attacker identifies Caddy 2.11.3 or earlier via response headers (Caddy advertises itself with a Server: Caddy header by default) or by behavioral fingerprinting. The attacker then probes for rewrite behavior — specifically responses that reflect or dereference URI components, and endpoints where a URI ending in ? produces unusual query-string handling. Shodan dorks such as product:Caddy or http.html:"Caddy" identify candidate hosts.

2. Triggering the flaw class. The attacker crafts a request URI that routes through a rewrite rule and supplies a trailing literal question mark such that the rewrite target ends with ?. Under the vulnerable version, Rewrite.Rewrite() passes the attacker-controlled replacement bytes through buildQueryString, which causes a second placeholder expansion over data the attacker partially controls.

3. Payload / execution method. At the vulnerability-class level, the payload is placeholder syntax embedded in attacker-controlled URI bytes — e.g., syntax that Caddy's placeholder engine recognizes for environment/request variables ({env.*}, {http.request.*}) or, if the file provider is registered, file placeholders. Because the second expansion is the flaw, the attacker does not need code execution primitives — only the ability to get placeholder tokens into the re-expanded byte stream. Where a matching file placeholder is available and the file provider is registered, the expanded result can contain the contents of a read-permitted file, which is returned to the attacker.

4. Post-exploitation impact. Successful exploitation yields information disclosure: environment variables, per-request variables, or readable files. Disclosed secrets (API keys, tokens, credentials in env vars, configuration or key material in readable files) can enable lateral movement or escalation against backend services that Caddy fronts. Availability can also be degraded (A:L) through expansion behavior. No public reporting attributes this CVE to a named threat actor or confirms in-the-wild exploitation; CISA KEV status is NO.

The critical gating condition: exploitation requires a vulnerable version and a compatible rewrite configuration. Deployments without such rewrite rules are not exploitable via this vector.

Impact Assessment

CVSS v3.1: 6.5 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

• AV:N (Network) — Exploitable by sending crafted HTTP requests; no local access needed.
• AC:L (Low) — No special preconditions beyond the vulnerable configuration; the described trigger (rewrite URI ending in ?) is straightforward to construct.
• PR:N (None) / UI:N (None) — No credentials and no user interaction; unauthenticated remote attackers qualify.
• S:U (Unchanged) — Impact stays within Caddy's security authority.
• C:L (Low Confidentiality) — Disclosed data is limited to environment/request variables and files readable by the Caddy process; not all data on the host.
• I:N (None) — No integrity impact scored.
• A:L (Low Availability) — Minor availability impact, consistent with resource-consuming expansion.

Blast radius. Caddy is a popular default-TLS web server/reverse proxy; exposure is broad in aggregate, but per-instance risk is concentrated in deployments that use rewrite directives with targets that can end in ?. For those, the front proxy may leak backend secrets: environment variables frequently contain credentials and tokens, and readable files can include configuration, certificates, or synchronized secrets. Because Caddy commonly terminates TLS in front of internal applications, the confidentiality impact can translate into direct access-enabling intelligence. The Medium rating correctly reflects that exploitation is configuration-gated and disclosure-limited, while public PoC absence reduces (but does not eliminate) near-term risk. Organizations fronting sensitive backends with affected Caddy instances should treat this as high operational priority despite the subsystem score.

Detection Guidance

Detection must focus on rewrite-bearing request patterns (trailing ? on rewritten URIs), placeholder-token injection payloads in URI/query components, anomalous request volume, and query strings that the server appears to interpret rather than pass through.

Sigma Rule

title: CVE-2026-77281 Caddy Rewrite Placeholder Injection Attempt
id: 8f4c2a91-7b3d-4e15-9a02-caddy77281a01
status: experimental
description: Detects HTTP requests attempting to trigger double placeholder expansion in
  Caddy rewrite/generate paths (CVE-2026-77281). Looks for placeholder tokens
  (e.g., {env., {http.request., {file.} combined with rewrite-triggering URIs ending in '?'.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77281
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: caddy
detection:
  selection_placeholder:
    cs-uri-query|contains:
      - '{env.'
      - '{http.request.'
      - '{file.'
  selection_trailing:
    cs-uri|endswith:
      - '?'
  selection_status:
    sc-status:
      - 200
      - 301
      - 302
      - 400
      - 500
  condition: selection_placeholder and (selection_trailing or selection_status)
falsepositives:
  - Legitimate applications passing literal brace characters in query strings
  - Fuzzing/security scanners in authorized tests
level: high

YARA Rule

rule CVE_2026_77281_Caddy_Placeholder_DoubleExpansion
{
    meta:
        author      = "valtersit.com"
        description = "Detects placeholder-token payloads associated with CVE-2026-77281 (Caddy rewrite double placeholder expansion)"
        reference    = "https://nvd.nist.gov/vuln/detail/CVE-2026-77281"
        date         = "2026-01-01"
        cve          = "CVE-2026-77281"
        severity     = "medium"

    strings:
        $ph_env   = "{env." nocase
        $ph_req   = "{http.request." nocase
        $ph_file  = "{file." nocase
        $caddy    = "Caddy" nocase
        $rewrite  = "rewrite" nocase

    condition:
        (2 of ($ph_*)) or
        (any of ($ph_*) and any of ($caddy, $rewrite))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77281 Caddy Rewrite Placeholder Injection Attempt"; flow:established,to_server; http.uri; content:"{env."; nocase; sid:90077281; rev:1; classtype:web-application-attack; reference:cve,2026-77281; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77281; metadata:affected_product Caddy, attack_target Server, deployment Perimeter, signature_severity Major;)

alert http any any -> any any (msg:"CVE-2026-77281 Caddy Rewrite Placeholder Injection Attempt (http.request)"; flow:established,to_server; http.uri; content:"{http.request."; nocase; sid:90077282; rev:1; classtype:web-application-attack; reference:cve,2026-77281; metadata:affected_product Caddy, signature_severity Major;)

alert http any any -> any any (msg:"CVE-2026-77281 Caddy Rewrite File Placeholder Injection"; flow:established,to_server; http.uri; content:"{file."; nocase; sid:90077283; rev:1; classtype:web-application-attack; reference:cve,2026-77281; metadata:affected_product Caddy, signature_severity Critical;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ http where url.query contains "{env." or url.query contains "{http.request." or url.query contains "{file." ]
  [ http where http.response.status_code >= 200 and http.response.status_code < 600 ]

Splunk SPL Query

index=web sourcetype=caddy_access OR sourcetype=nginx:plus:access
| eval uri=coalesce(uri, cs_uri, request_uri), status=coalesce(status, sc_status)
| where match(uri, "\\{(env|http\.request|file)\.") OR (like(uri, "%?") AND match(uri, "\{[a-zA-Z0-9_.]+\}"))
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, uri
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ")
| sort - count

Wazuh OSSEC Rule

<group name="web,caddy,cve-2026-77281,">
  <rule id="100781" level="10">
    <if_sid>31100,31101,31103,31104,31105,31106,31107,31108,31109</if_sid>
    <regex type="pcre2">(?i)\{(env|http\.request|file)\.</regex>
    <description>CVE-2026-77281: Possible Caddy rewrite placeholder injection attempt via {env.}/{http.request.}/{file.} token in request URI</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_77281,attack,</group>
  </rule>

  <rule id="100782" level="8">
    <if_sid>100781</if_sid>
    <match>?</match>
    <description>CVE-2026-77281: Trailing question mark observed with placeholder token (potential rewrite double-expansion trigger)</description>
    <group>cve_2026_77281,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description explicitly states the issue is fixed in Caddy 2.11.4, but Patch Sources are empty and Vendor Fix/Workarounds are not provided. Treat tracking as unresolved until the upstream release is independently confirmed.

1) Immediate mitigations (while patch validation is pending):

• Audit Caddy configurations for rewrite directives whose target URI can end with, or be manipulated to end with, a literal ?. Remove or restructure such rules so the rewrite target never terminates in ? and attacker-influenced bytes are not fed back through query-string construction.
• Avoid passing attacker-controlled values into rewrite targets where they will be re-expanded. Prefer static rewrite targets.
• If file placeholders or the file provider are unnecessary, do not register/enable the file provider — this eliminates the file-disclosure branch described in the NVD text.
• Front affected Caddy instances with a WAF/edge filter that blocks request URIs containing placeholder tokens ({env., {http.request., {file.) and suspicious trailing-? patterns.
• Restrict the Caddy process's filesystem read permissions (least privilege) to bound any file-disclosure impact. Segment environment variables so no sensitive secrets are present in the Caddy process environment.
• Monitor and rate-limit anomalous rewrite-triggering request patterns.

2) Patch / upgrade steps:

• Upgrade Caddy to 2.11.4 (the version identified in the NVD description as containing the fix). Verify the release notes and checksum/signature of the upstream binary before deployment.
• After upgrade, re-validate rewrite rules to confirm trailing-? cases no longer cause re-expansion.
• Because patch confidence is 0/4, independently confirm the fix in Caddy 2.11.4 against your specific rewrite configuration rather than relying on version-string alone.

3) Long-term hardening:

• Maintain an inventory of Caddy versions and rewrite configurations; track Caddy security advisories and apply updates promptly given Caddy's role as an internet-facing TLS termination layer.
• Adopt configuration review gates that flag directives capable of interpreting user input (rewrite, templating, placeholders) as high-risk.
• Run the Caddy process with minimal filesystem permissions and a sanitized environment; store secrets in a secret manager rather than process environment variables where feasible.
• Deploy the Sigma/Suricata/Wazuh detections above into production monitoring and alert on placeholder-token injection attempts to catch exploitation attempts (and post-patch probing) in near real time.
• Reassess periodically for public PoC/exploit emergence and EPSS scoring; note EPSS is not yet scored by FIRST.org.

References

1. NVD — CVE-2026-77281: https://nvd.nist.gov/vuln/detail/CVE-2026-77281
2. Caddy project — official repository/security advisories and release notes for v2.11.4: https://github.com/caddyserver/caddy/releases
3. Caddy documentation — rewrite directive and placeholder behavior: https://caddyserver.com/docs/caddyfile/directives/rewrite and https://caddyserver.com/docs/conventions (Caddyfile concepts)
4. CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / in-the-wild status: No known threat actor campaigns and no exploit-in-the-wild evidence are associated with this CVE in the supplied data. CISA KEV: NO. PoC: None. Nuclei template: NO. Exploit code: NO. EPSS: Not yet scored by FIRST.org.