CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache HTTP Server deployments using mod_dav_fs are affected from version 2.4.0 through 2.4.68 on all platforms. The issue involves exposure of the .DAV state directory through GET requests.
What does an attacker need to do to exploit this issue?
A remote client can request the .DAV state directory with a GET request. This may allow the client to read WebDAV dead properties for resources the client is not authorized to author.
How can I determine whether my server is affected?
Check whether the server runs Apache HTTP Server 2.4.0 through 2.4.68 and uses mod_dav_fs. Also review whether the .DAV state directory can be reached through external GET requests.