https://seclists.org/oss-sec/2026/q4/19: CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database ad access
Affected Software
Frequently Asked Questions
What conditions are required for exploitation?
The server must use mod_dav_fs and expose a reachable .DAV state directory. A remote client can then issue a GET request to read WebDAV dead properties for resources it is not authorized to author.
What information can an attacker obtain?
The issue exposes internal state files containing WebDAV dead properties. The provided information does not indicate that it permits modification of those properties or access to resource content beyond the state data.
Which deployments should be prioritized for remediation?
Prioritize Apache HTTP Server deployments running versions 2.4.0 through 2.4.68 that use mod_dav_fs, particularly where WebDAV resources and their .DAV state directories are reachable by remote clients. The issue applies on all platforms.
How can I determine whether an instance is affected?
Check whether the server version is between 2.4.0 and 2.4.68 and whether mod_dav_fs is in use. An affected configuration permits a GET request to the .DAV state directory to retrieve state data for resources the requester cannot author.
What fixes the issue?
Upgrade to Apache HTTP Server 2.4.69 or later. The issue was fixed in the 2.4.x branch by revision r1938668 and 2.4.69 was released on 2026-10-01.