Description
A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Published: 2026-06-08
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A path handling flaw in mod_dav_fs of Apache HTTP Server up to version 2.4.67 allows an authenticated WebDAV content author to directly manipulate trusted DAV property databases. This weakness, classified as CWE‑22 and CWE‑668, can cause child process crashes, resulting in a loss of service availability.

Affected Systems

The vulnerability affects Apache HTTP Server versions 2.4.67 and earlier. The affected product is the Apache Software Foundation’s Apache HTTP Server; no other vendors or sub‑products are listed.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The CVSS score is 9.1. Based on the description, the likely attack vector is a remote WebDAV client that has content author privileges to the server. The flaw involves path handling that permits manipulation of property files (CWE‑22), so an attacker can influence internal file paths to corrupt or overwrite DAV property databases, triggering child process crashes. No additional prerequisites are specified. Because the flaw can crash child processes, a remote attacker who can perform WebDAV operations may trigger a denial of service.

Generated by OpenCVE AI on June 13, 2026 at 13:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.68 or later.
  • If an upgrade is not feasible, disable the mod_dav_fs module or remove WebDAV functionality from the configuration to eliminate the attack surface.
  • Restrict WebDAV access to trusted administrators and ensure no WebDAV directories are exposed to public users.

Generated by OpenCVE AI on June 13, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4629-1 apache2 security update
History

Sat, 13 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 09 Jun 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Tue, 09 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 23:30:00 +0000

Type Values Removed Values Added
References

Mon, 08 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Mon, 08 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
Description A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Title Apache HTTP Server: mod_dav_fs protected directory access
Weaknesses CWE-668
References

Subscriptions

Apache Http Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-06-09T12:13:11.748Z

Reserved: 2026-04-28T15:53:30.262Z

Link: CVE-2026-42535

cve-icon Vulnrichment

Updated: 2026-06-09T12:10:54.881Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-08T16:16:39.127

Modified: 2026-06-09T16:00:53.157

Link: CVE-2026-42535

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-08T15:14:49Z

Links: CVE-2026-42535 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-13T13:30:09Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-668

    Exposure of Resource to Wrong Sphere