Apache HTTP Server 2.4.67 and earlier contain a client‑side cross‑site scripting flaw in the mod_proxy_ftp module. When the module generates an HTML directory listing for FTP resources, directory or file names that are not properly sanitized are inserted into the page. This can allow an attacker to inject JavaScript that will run in the browsers of users who view the listing.

The flaw affects installations of Apache HTTP Server version 2.4.67 or earlier that have mod_proxy_ftp enabled and use directory listing of FTP resources either as a forward or reverse proxy. Systems running newer releases are not vulnerable. The vendor is the Apache Software Foundation.

Accessing a proxy URL that triggers a directory listing can be performed over the network without local privileges. Because the exploit requires only that a client browser renders the generated page, the risk is that arbitrary script code could execute in the client context. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly disclosed exploit has been reported at this time. However, the presence of client‑side script execution remains a high‑impact concern for exposed directory listings.