Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Caddy Web Server Improper Encoding or Escaping of Output Vulnerability - CVE-2026-52846 - Vulnerability Database
Caddy Web Server

Caddy Web Server Improper Encoding or Escaping of Output Vulnerability - CVE-2026-52846

Medium
Reference: CVE-2026-52846
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-52846
Title: Caddy Web Server Improper Encoding or Escaping of Output Vulnerability
Overview:

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4 Caddys stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML such as ltltgtimg srcx onerroralert()gt can bypass the tag-stripping logic potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.