Skip to main content

Apache HTTP Server EUVDEUVD-2026-90897

| CVE-2026-58415 MEDIUM
Files or Directories Accessible to External Parties (CWE-552)
2026-10-01 apache GHSA-p249-893m-q7j8
Apache Information Disclosure Path Traversal Red Hat Suse Apache Http Server Apache Software Foundation
5.3
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify WebDAV-enabled Apache server
  2. Exploit
    Send GET request for .DAV state directory
  3. Execution
    Server returns internal dead-property state files
  4. Impact
    Read properties of unauthorized resources

Vulnerability Assessment

Weakness
CWE
CWE-552
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK

2 techniques across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the server to be running mod_dav plus mod_dav_fs with WebDAV enabled, and the mod_dav_fs internal state directory (.DAV, which stores lock database and dead properties) must reside within a location that is reachable by an HTTP GET request. Exploitation is NOT possible against a default Apache configuration because WebDAV/mod_dav_fs is not enabled by default. Limiting factors: the leak is confined to WebDAV dead properties (client-set metadata) of resources, is read-only with no write or execution capability, and only affects deployments that actually serve WebDAV collections whose .DAV directory is web-accessible.
Impact

No CVSS vector is provided by Apache or NVD in the source data, so severity must be inferred from the description and CWE-552 (Files or Directories Accessible to External Parties). The impact is read-only information disclosure: a remote client can retrieve WebDAV 'dead properties' (arbitrary client-set metadata) of resources it is not authorized to author by requesting the mod_dav_fs .DAV state directory. There is no code execution, write, or availability impact described. EPSS, CISA KEV, and POC signals are all ABSENT from the input - no public exploit identified at time of analysis and no evidence of active exploitation. Critically, exploitation is gated on a non-default configuration: mod_dav/mod_dav_fs (WebDAV) must be enabled AND the on-disk .DAV state directory must be reachable via HTTP GET under a served location. This is therefore a genuine but LOW-to-MEDIUM priority issue for the subset of Apache deployments running WebDAV, not a high-urgency flaw for the typical Apache install. Priority should be driven by whether WebDAV is in use, not by Apache's ubiquity alone.
Exploit ScenarioDerived

An Apache HTTP Server (2.4.0-2.4.68) is configured with mod_dav_fs to serve a WebDAV collection where multiple users store resources. An unauthenticated remote client sends a GET request targeting the server's .DAV internal state directory and receives the stored dead properties for resources it has no authoring rights to, leaking potentially sensitive client-defined metadata. No public exploit code is identified at time of analysis, but the attack requires only a single crafted HTTP GET request.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.69 - upgrading to 2.4.69 or later is the primary fix, and installations tracking the 2.4.x branch can confirm the release via the advisory at https://httpd.apache.org/security/vulnerabilities_24.html. Where an immediate upgrade is not possible, the most direct compensating control is to stop serving the state directory: add an explicit deny for the .DAV path (for example a DirectoryMatch or RewriteRule returning 403/404 for any request whose path contains /.DAV/), which is low-risk for legitimate clients because WebDAV clients do not need to GET that directory, at the cost of an extra configuration surface that must be replicated in every affected vhost. If WebDAV is not actually required, disabling mod_dav and mod_dav_fs (removing the LoadModule lines and any DAV On directives) eliminates the exposure entirely, with the side effect that WebDAV-based publishing and locking stops working. Relocating the mod_dav_fs state directory outside the document root addresses the exposure at its source but requires a controlled reconfiguration and may invalidate existing lock state, so it should be done during a maintenance window. As a general precaution, front-end proxies or WAF rules can also reject requests for dot-directories, though such filtering is bypassable through encoding tricks and should not be treated as equivalent to the upstream patch.

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.68

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

mod_dav implements WebDAV for Apache HTTP Server and delegates persistent storage of protocol state to a provider backend; mod_dav_fs maintains that state on disk inside a hidden .DAV directory associated with each WebDAV collection. That directory holds the lock database and the 'dead properties' - arbitrary client-supplied name/value metadata that is not defined by the WebDAV specification. Because the .DAV state directory can end up beneath the served document tree, an HTTP GET aimed at it can return the state file contents instead of the 403/404 that should be produced, exposing dead properties (and, indirectly, the existence and metadata of resources) belonging to a client that has no authoring rights over them. The root-cause class is CWE-552: files or directories that should be internal are reachable by external parties, rather than a memory-safety or injection defect. The CPE cpe:2.3:a:apache_software_foundation:apache_http_server:*:* indicates the vendor-wide product entry, with the version range refined by the description to 2.4.0 through 2.4.68 on all platforms; no CVSS vector is supplied by Apache or NVD in the source data, so severity is inferred from the description and CWE-552, and our independent assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 5.3 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI 5.3 MEDIUM

Remote GET request with no auth or interaction (AV:N/AC:L/PR:N/UI:N); only limited metadata disclosure gives C:L, with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

DescriptionCVE.org

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Threat Intelligence Overview

EPSS Score
0.3%
Top 80% exploitable
Prevalence
Ubiquitous
Apache HTTP Server is one of the most widely deployed web servers globally
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
High
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all
CVE-2025-11371 HIGH POC
7.5
CVE-2016-3715 MEDIUM POC
5.5
CVE-2017-16651 HIGH POC
7.8
CVE-2023-6266 HIGH POC
7.5
CVE-2021-22015 HIGH POC
7.8
CVE-2017-14942 CRITICAL POC
9.8
CVE-2015-5211 CRITICAL POC
9.6
CVE-2024-53676 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:74858 ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58415 ADVISORY https://seclists.org/oss-sec/2026/q4/19 ADVISORY https://ubuntu.com/security/notices/USN-8931-1 ADVISORY https://vuldb.com/vuln/412717 REF http://www.openwall.com/lists/oss-security/2026/10/01/20

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy