CVE-2026-42535

Apache HTTP Server: mod_dav_fs protected directory access

State: Published
Severity: 9.1 Critical
Published: Jun 8, 2026
Updated: Jun 9, 2026
Reserved: Apr 28, 2026

Description

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	CISA-ADP

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
Apache HTTP ServerApache Software Foundation	2.4.67 and earlierAffected

References

https://httpd.apache.org/security/vulnerabilities_24.htmlvendor-advisory
http://www.openwall.com/lists/oss-security/2026/06/08/8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.