Detections
Analytics
FreeBSD : caddy -- multiple vulnerabilities (94f93681-6775-11f1-8044-002590af0794)
medium Nessus Plugin ID 321073
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 94f93681-6775-11f1-8044-002590af0794 advisory.Caddy project reports:
Caddy 2.11.4 contains multiple security fixes.
GitHub Security Advisory GHSA-qrp7-cvwr-j2c6 reports:
Windows-encoded backslashes in request paths could bypass path-scoped authorization rules before files are served by file_server.
GitHub Security Advisory GHSA-f59h-q822-g45g reports:
forward_auth copy_headers could fail to remove underscore aliases of copied identity headers before FastCGI header normalization, allowing identity or group header spoofing.
GitHub Security Advisory GHSA-vcc4-2c75-vc9v reports:
The stripHTML template function could fail to remove malformed HTML, potentially allowing client-side cross-site scripting if untrusted output is later rendered as HTML.
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://github.com/caddyserver/caddy/releases/tag/v2.11.4
http://www.nessus.org/u?bd5e5085
http://www.nessus.org/u?cd7ba5f7
Plugin Details
Severity: Medium
ID: 321073
File Name: freebsd_pkg_94f93681677511f18044002590af0794.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 6/14/2026
Updated: 6/14/2026
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-52846
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:caddy, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Ease: No known exploits are available
Patch Publication Date: 6/13/2026
Vulnerability Publication Date: 6/13/2026