Monthly
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.