CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access
CVE-2026-58415 lets remote clients read WebDAV dead properties from Apache mod_dav_fs state files.
Apache disclosed CVE-2026-58415, a low-severity information disclosure in mod_dav_fs affecting Apache HTTP Server 2.4.0 through 2.4.68 on all platforms, with the issue addressed before 2.4.69. Internal WebDAV state files are accessible to external parties, so a remote client can read dead properties of resources it cannot author by requesting the .DAV state directory with GET. No active exploitation is described.
- CVE-2026-58415 is rated low.
- Affects Apache HTTP Server 2.4.0 through 2.4.68; fixed before 2.4.69.
- Remote clients can read WebDAV dead properties they cannot author.
- Access is through a GET request for the mod_dav_fs .DAV state directory.
Vulnerabilities mentionedAll →
- CVE-2026-584155.3—WebDAV state-file disclosure in Apache HTTP Serverpublished · Apache Software Foundation Apache HTTP Server (mod_dav_fs)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-58415 | WebDAV state-file disclosure in Apache HTTP Server In Apache HTTP Server before 2.4.69, mod_dav_fs leaves its internal WebDAV state files reachable by remote clients. A client that is not allowed to author a resource can still read that resource’s WebDAV dead properties by sending a GET request for the .DAV state directory. Those properties are metadata and may include sensitive or user-supplied values that were meant to stay restricted to authors. The issue affects mod_dav_fs on all platforms from 2.4.0 through 2.4.68; servers that do not enable this WebDAV filesystem provider are not exposed. It is not in CISA KEV, has no published CVSS score yet, and no public proof-of-concept is known. Upgrade Apache HTTP Server to 2.4.69 or later. Until that is possible, disable mod_dav and mod_dav_fs if WebDAV is not required, or block client access to the WebDAV .DAV state directory. Check whether dead properties stored for WebDAV resources contain sensitive data that may already have been readable. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit:...
This source does not provide full text. Read it at seclists.org.