CVE-2026-29170CWE-79

Apache HTTP Server: mod_proxy_ftp XSS

Medium · published June 8, 2026

CVSS v3.1
6.1
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-08T15:10Z
EPSS history
Timeline
  • 08 JUN 15:10Z
    Apache HTTP Server: mod_proxy_ftp XSS
    cvelistv5