Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache HTTP Server up to 2.4.68 exposes hidden files
published 1 month ago
Summary
Versions of Apache HTTP Server from 2.4.0 through 2.4.68 store internal WebDAV state information in a hidden ".DAV" directory. An external user can request that directory and see data they should not see, potentially revealing configuration or other sensitive details. Upgrade to version 2.4.69 or later, or block access to the ".DAV" folder, to eliminate the risk.
What to do
- Update httpd to version 2.4.69-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | httpd |
< 2.4.69-1 Fix: upgrade to 2.4.69-1
|
| Azure Linux:3 | azure | httpd | <= 2.4.68-1 |
Original advisory text
CVE-2026-58415 affecting package httpd for versions less than 2.4.69-1
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
References
Timeline
Published1 Oct 2026
Updated2 Nov 2026
First seen9 Oct 2026
Sources
AZL-106791 · OSV
Track software like this
Free during beta