CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure
Apache rates CVE-2026-79768, a mod_userdir information disclosure through version 2.4.68, as low.
Apache disclosed CVE-2026-79768, a low-severity information disclosure involving mod_userdir in Apache HTTP Server. The issue affects versions from 2.4.0 through 2.4.68. The oss-security post by Eric Covener points to the mod_userdir UserDir documentation and credits finder Vlatko. No in-the-wild exploitation is described.
- CVE-2026-79768 is an information disclosure in mod_userdir.
- Apache HTTP Server 2.4.0 through 2.4.68 is affected.
- Apache rated the severity low.
- The note credits finder Vlatko and does not report exploitation.
Vulnerabilities mentionedAll →
- CVE-2026-797685.3—Path-equivalence info leak in Apache mod_userdirpublished · Apache Software Foundation Apache HTTP Server (mod_userdir)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-79768 | Path-equivalence info leak in Apache mod_userdir CVE-2026-79768 is a path-equivalence flaw (CWE-55) in Apache HTTP Server’s mod_userdir. When UserDir is set to an absolute path without wildcards, a request that includes a single-dot directory segment ('/./') can be treated differently from the intended per-user directory mapping. Related reporting describes the result as information disclosure, so files outside the directory the administrator meant to expose may be readable. It affects Apache HTTP Server 2.4.0 through 2.4.68 only in that specific UserDir configuration, not every httpd install. There is no known public proof-of-concept, it is not listed in CISA KEV, and CVSS is not yet scored. On Apache HTTP Server 2.4.0 through 2.4.68, review UserDir: this flaw applies only when mod_userdir uses an absolute, non-wildcard path (the second UserDir form). Upgrade to a release newer than 2.4.68 once Apache publishes it; until then disable mod_userdir if ~user directories are not required, or avoid that absolute UserDir form. Check access logs for '/./' sequences in user-directory URLs. |
Posted by Eric Covener on Oct 01 Severity: low https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit: Vlatko...
This source does not provide full text. Read it at seclists.org.