CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access
Apache HTTP Server: moddavfs property database read access
Other sources
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache HTTP Server deployments using mod_dav_fs are affected from version 2.4.0 through 2.4.68 on all platforms. The issue involves exposure of the .DAV state directory through GET requests.
What does an attacker need to do to exploit this issue?
A remote client can request the .DAV state directory with a GET request. This may allow the client to read WebDAV dead properties for resources the client is not authorized to author.
How can I determine whether my server is affected?
Check whether the server runs Apache HTTP Server 2.4.0 through 2.4.68 and uses mod_dav_fs. Also review whether the .DAV state directory can be reached through external GET requests.