AI analysis
CVE-2026-79768 is a path-equivalence flaw (CWE-55) in Apache HTTP Server’s mod_userdir. When UserDir is set to an absolute path without wildcards, a request that includes a single-dot directory segment ('/./') can be treated differently from the intended per-user directory mapping. Related reporting describes the result as information disclosure, so files outside the directory the administrator meant to expose may be readable. It affects Apache HTTP Server 2.4.0 through 2.4.68 only in that specific UserDir configuration, not every httpd install. There is no known public proof-of-concept, it is not listed in CISA KEV, and CVSS is not yet scored.
What to do: On Apache HTTP Server 2.4.0 through 2.4.68, review UserDir: this flaw applies only when mod_userdir uses an absolute, non-wildcard path (the second UserDir form). Upgrade to a release newer than 2.4.68 once Apache publishes it; until then disable mod_userdir if ~user directories are not required, or avoid that absolute UserDir form. Check access logs for '/./' sequences in user-directory URLs.
Affected
| Apache Software Foundation Apache HTTP Server (mod_userdir) | 2.4.0 through 2.4.68, only when UserDir is an absolute non-wildcard path |
Estimated exposure
moderatethousands to low tens of thousands of servers (config subset, not all Apache installs) — Apache HTTP Server is widely deployed (tens of millions of sites), but the bug only applies to the less common absolute non-wildcard UserDir setup used on some shared-hosting and academic servers; no public scan count of that configuration…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.