BIT-apache-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access

Q: Which deployments should be prioritized for remediation?

Apache HTTP Server deployments running version 2.4.67 or earlier with mod_dav_fs should be prioritized, particularly where WebDAV content authors can upload or manage content.

Q: What access does an attacker need?

The attacker needs to be a WebDAV content author. No additional privileges or user interaction are indicated by the provided severity vector.

Q: What should be done if the server is affected?

Upgrade Apache HTTP Server to version 2.4.68, which fixes the issue. Until upgrading, restrict or suspend WebDAV content-author access where feasible.

Q: How can administrators assess exposure?

Check the Apache HTTP Server version and whether mod_dav_fs is enabled. Also identify accounts or users with WebDAV content-author access, since those users could manipulate trusted DAV property databases.

Published Jun 8, 2026

Updated

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<=2.4.67

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server mod_dav_fs to a version that resolves this vulnerability.
Fixed in 2.4.68

Event History

Jun 8, 2026

CVE Published

via OSV·03:14 PM

Data Sourced

via OSV·03:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Apache HTTP Server deployments running version 2.4.67 or earlier with mod_dav_fs should be prioritized, particularly where WebDAV content authors can upload or manage content.

What access does an attacker need?

The attacker needs to be a WebDAV content author. No additional privileges or user interaction are indicated by the provided severity vector.

What should be done if the server is affected?

Upgrade Apache HTTP Server to version 2.4.68, which fixes the issue. Until upgrading, restrict or suspend WebDAV content-author access where feasible.

How can administrators assess exposure?

Check the Apache HTTP Server version and whether mod_dav_fs is enabled. Also identify accounts or users with WebDAV content-author access, since those users could manipulate trusted DAV property databases.

BIT-apache-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be prioritized for remediation?

What access does an attacker need?

What should be done if the server is affected?

How can administrators assess exposure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for remediation?

What access does an attacker need?

What should be done if the server is affected?

How can administrators assess exposure?