CVE-2026-42535CWE-668

Apache HTTP Server: mod_dav_fs protected directory access

Critical · published June 8, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00710 · 53.0th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-06-08T15:14Z
EPSS history
Timeline
  • 08 JUN 15:14Z
    Apache HTTP Server: mod_dav_fs protected directory access
    cvelistv5