A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
The vulnerability (CWE-668 — exposure of resource to wrong actor) results from improper path handling in the mod_dav_fs module. A user with permissions to publish content via WebDAV can craft a request that allows him to access internal DAV property databases (.dav files), which should be protected against direct modification by clients. Manipulation of these files can trigger a crash of Apache child processes, as the server loses consistency of DAV configuration data.
An attacker with WebDAV content author privileges can modify trusted DAV property databases and cause repeated crashes of server child processes, leading to disruption of availability (DoS) and data integrity violations.
Apache HTTP Server should be updated to version 2.4.68, which eliminates this vulnerability. Patch is available according to vendor information at https://httpd.apache.org/security/vulnerabilities_24.html
Apache HTTP Server version 2.4.67 and earlier with the mod_dav_fs module enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HApache HTTP Server
APPApache< 2.4.68
Related vulnerabilities
Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie
Apache HTTP Server 2.4.50 — path traversal i RCE (niewystarczający patch CVE-2021-41773)
Apache HTTP Server 2.4.49 — path traversal i RCE (aktywnie exploitowany)
SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego
Use-after-free w Apache HTTP Server z mod_ldap (CVE-2026-29167)