CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure
Apache HTTP Server: moduserdir information disclosure
Other sources
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.html#userdir)
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1
Event History
Frequently Asked Questions
Which Apache HTTP Server deployments are affected?
Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_userdir is configured with an absolute, non-wildcard UserDir directive.
What does an attacker need to send to trigger the issue?
The issue involves path equivalence using a '/./' single-dot directory path. The affected configuration prerequisite is an absolute non-wildcard UserDir directive in mod_userdir.