The vulnerability originates from improper privilege management in Apache HTTP Server 2.4.67 and earlier. Local authors of .htaccess files can exploit expressions to read files that the httpd user normally cannot access. This creates a privilege escalation path that allows the attacker to read privileged or sensitive files, compromising confidentiality and potentially exposing configuration or user data. The weakness aligns with CWE-266 and CWE-269.

The affected product is Apache HTTP Server, on all supported platforms. Any installation running version 2.4.67 or earlier is vulnerable. Versions 2.4.68 and later contain the fix. Affected modules include those that interpret .htaccess expressions.

The CVSS score is 5.5, and the EPSS score of 0.00015 (0.015%) indicates a very low probability of exploitation. The vulnerability is local, requiring the attacker to have write access to a .htaccess file in a directory served by Apache. While this limits exposure to attackers who can write configuration files, the ability to read privileged files is a powerful local privilege escalation vector. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation but still presenting a significant risk to local attackers.