CVE-2026-58415

In Apache HTTP Server before 2.4.69, mod_dav_fs leaves its internal WebDAV state files reachable by remote clients. A client that is not allowed to author a resource can still read that resource’s WebDAV dead properties by sending a GET request for the .DAV state directory. Those properties are metadata and may include sensitive or user-supplied values that were meant to stay restricted to authors. The issue affects mod_dav_fs on all platforms from 2.4.0 through 2.4.68; servers that do not enable this WebDAV filesystem provider are not exposed. It is not in CISA KEV, has no published CVSS score yet, and no public proof-of-concept is known.

What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until that is possible, disable mod_dav and mod_dav_fs if WebDAV is not required, or block client access to the WebDAV .DAV state directory. Check whether dead properties stored for WebDAV resources contain sensitive data that may already have been readable.