CVE-2022-29718: Caddyserver Caddy

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

Affected products

• Caddyserver Caddy: from 2.4.0, before 2.5.0 (fixed in 2.5.0)

Published 2022-06-02. Last modified 2026-06-17.