The vulnerability exploits a path equivalence bug in Apache HTTP Server’s mod_userdir module, where the notation "/./" is treated as equivalent to the parent directory. When mod_userdir is configured with an absolute non‑wildcard UserDir directive, an attacker can craft specially formatted URLs to reach files outside the intended user directory, potentially exposing server configuration files or sensitive data. The weakness is classified as CWE-41 (Path Traversal) and CWE-55 (Inadequate Path Canonicalization).

All installations of Apache HTTP Server from 2.4.0 through 2.4.68 that enable the mod_userdir module with an absolute non‑wildcard UserDir directive are affected. This includes any web server instance using that directive within the specified version range.

The vulnerability is remotely exploitable via standard HTTP requests; the likely attack vector is inferred to be a crafted HTTP request containing the vulnerable "/./" pattern. The EPSS score of < 1% suggests a very low probability of exploitation, and the absence from the CISA KEV catalog indicates no documented public exploitation. However, because the flaw allows arbitrary file disclosure, the impact can be significant for any affected deployment. The CVSS score of 5.3 reflects moderate severity of the issue. Deployers should treat this as a moderate‑risk condition pending remediation.