CVE-2026-58415
Received Received - Intake

Information Disclosure in Apache HTTP Server mod_dav_fs

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-58415
EUVD
EUVD-2026-90897

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache_software_foundation apache_http_server From 2.4.0 (inc) to 2.4.68 (inc)
apache apache_http_server From 2.4.0 (inc) to 2.4.68 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows remote clients to access internal state files in mod_dav_fs of Apache HTTP Server versions before 2.4.69. These files contain WebDAV dead properties that the client cannot normally read, exposing sensitive metadata about resources.

Detection Guidance

To detect this vulnerability, check if your Apache HTTP Server version is between 2.4.0 and 2.4.68. Run the command: httpd -v. If the version falls within this range, the system is potentially vulnerable.

Impact Analysis

An attacker could exploit this to read sensitive metadata about files they don't have access to, potentially revealing information about internal file structures or configurations. This could aid further attacks or data exfiltration attempts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data metadata, potentially violating privacy regulations like GDPR or HIPAA by exposing information about protected resources without proper authorization.

Mitigation Strategies

Upgrade Apache HTTP Server to version 2.4.69 or later immediately. Download the latest version from the official Apache website and follow the upgrade instructions for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart