Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache HTTP Server allows unauthorized file access

published 1 month ago
Summary

Versions of Apache HTTP Server up to 2.4.68 mishandle a special "./" path in the user directory feature, which can let an attacker reach files outside the intended user folder. This could expose sensitive data or allow further attacks. Update the server to version 2.4.69 or later to fix the problem.

What to do
  • Update httpd to version 2.4.69-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 – httpd < 2.4.69-1
Fix: upgrade to 2.4.69-1
Azure Linux:3 azure httpd <= 2.4.68-1
Original advisory text
CVE-2026-79768 affecting package httpd for versions less than 2.4.69-1
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)



This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
References
Timeline
Published1 Oct 2026
Updated2 Nov 2026
First seen9 Oct 2026
Sources
AZL-106776 · OSV
Track software like this
Free during beta