The vulnerability arises from the default installation directory of the Apache Lounge Windows distribution of Apache HTTP Server, which is placed on the C:\ drive and inherits write permissions for Authenticated Users. This flaw lets any local authenticated user create or modify files in the installation directory, potentially allowing the alteration of server configuration files or the deployment of malicious executables. The result is that an attacker could gain the ability to run arbitrary code on the server or alter its behavior, compromising confidentiality, integrity, and availability. The weakness aligns with improper permission assignments (CWE‑732).

Apache Lounge Windows distribution of Apache HTTP Server is affected. No specific version numbers are disclosed. The issue is tied to installations that use the default C:\ path with its uncontrolled permissions.

The attack vector is local and requires an authenticated user account that can write to the installation directory. Because the flaw permits modification of critical server files, successful exploitation can lead to arbitrary code execution. The CVSS score of 9.1 indicates high severity, while the EPSS score of < 1% indicates a low but non-zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The risk remains high for systems where the installation path is left at the default location and where Authenticated Users have write access.