Apache HTTP Server EUVD-2026-90909

Exploitation requires that the target Apache HTTP Server (2.4.0 through 2.4.68) has mod_userdir enabled AND configured specifically with the absolute, non-wildcard form of the UserDir directive (the 2nd syntax form documented at mod_userdir, e.g. 'UserDir /some/absolute/path'). Servers using the default wildcard/username form, or without mod_userdir loaded, are not affected. The limiting factor is therefore this non-default configuration: deployments that do not use absolute non-wildcard UserDir have no exposure regardless of version. The flaw is network-reachable over HTTP; authentication requirements are not confirmed from available data because no CVSS vector was provided.

This is a path-equivalence flaw (CWE-55, '/./' single-dot directory) in Apache HTTP Server's mod_userdir, affecting 2.4.0 through 2.4.68 and tagged as information disclosure. No CVSS score or vector was provided in the input, so attack vector, complexity, and privilege requirements cannot be confirmed from vendor/NVD data and are assessed independently below. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The most important risk-limiting signal is in the description itself: the issue only manifests when mod_userdir is configured with the absolute, non-wildcard UserDir form (the 2nd documented syntax) - this is a non-default, operator-chosen configuration, which sharply narrows the real-world exposed population even though Apache httpd itself is ubiquitous. Net assessment: likely a genuine but modest-priority information-disclosure issue (not a high-CVSS-but-no-impact false alarm, but also not an emergency) whose real risk is gated almost entirely by whether the specific UserDir configuration is in use. Recommend patching to 2.4.69+ on a normal cycle and prioritizing hosts that actually use absolute non-wildcard UserDir.

A remote attacker sends an HTTP request to a shared-hosting Apache server whose mod_userdir uses an absolute non-wildcard UserDir, inserting a '/./' sequence into the path to defeat the intended user-directory mapping. The equivalent path resolves to files the server did not intend to expose through userdir, disclosing their contents. No public proof-of-concept was identified at time of analysis, and exploitation is limited to servers running the specific vulnerable configuration.