The Caddy vars_regexp matcher performs an unintended double expansion of user-controlled input through the replacer. The likely attack vector is sending a crafted HTTP request header containing placeholders such as {env.DATABASE_URL} or {file./etc/passwd}. When a header such as {http.request.header.X-Input} contains placeholders that reference environment variables or file paths (e.g., {env.DATABASE_URL} or {file./etc/passwd}), the value is resolved twice, leaking the requested data to the attacker. This flaw is categorized as Information Exposure and Improper Handling of Special Characters, allowing sensitive data to be read without authentication or authorization.

CaddyServer Caddy, versions starting from 2.7.5 up to but not including 2.11.2, are affected. All installations of these versions that use the vars_regexp matcher in any header-based request can be exploited.

The flaw has a CVSS score of 5.5, reflecting medium severity. EPSS indicates a low probability of exploitation (<1%). It is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability from the network by sending a crafted HTTP request header; no privileged access or local compromise is required. Once triggered, confidential environment variables, file contents, and system information can be exposed to the attacker, potentially leading to credential theft and subsequent attacks.