CVE-2026-77281

# Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer **Tested against:** `caddy:2.11.3` (official Docker image, SHA verified at runtime) **Reproduction environment:** Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 10 host, isolated containers, no network egress required for any of the exploits This advisory bundles three independent issues discovered together during a source review of the placeholder/replacer layer. Each issue has been reproduced end-to-end against the unmodified `caddy:2.11.3` image with the minimal Caddyfile that the documentation suggests for the affected feature. --- ## Issue 1: Rewrite handler — placeholder double-expansion enables env var / file disclosure **File:** `modules/caddyhttp/rewrite/rewrite.go:215-249` and `buildQueryString` at `327` **Class:** CWE-94 (Code Injection), same bug class as CVE-2026-30852 (`vars_regexp`) **Severity:** Low (requires operator config with trailing `?` in rewrite URI) ### Root cause When the operator's `rewrite` URI template: 1. Contains a placeholder that resolves to request data (e.g. `{http.request.header.X-Foo}`), AND 2. Ends with a literal `?` (with empty query side) …then the bytes produced by the **first** Replacer pass (which include attacker-controlled header values) are fed through `buildQueryString`, which runs a **second** Replacer pass and resolves any placeholders the attacker injected. ```go // rewrite.go (abridged) newPath = repl.ReplaceAll(path, "") // pass 1 — header expanded if before, after, found := strings.Cut(newPath, "?"); found { var injectedQuery string newPath, injectedQuery = before, after if query == "" { // trailing-? branch query = injectedQuery // attacker bytes flow into 'query' } } if query != "" { newQuery = buildQueryString(query, repl) // pass 2 — RE-EXPANDS attacker input } ``` This is the same gadget that was patched in `vars_regexp` (CVE-2026-30852). The f