CVE-2026-58415
published 2026-10-01CVE-2026-58415: Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.53%
43.3th percentile
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: Information disclosure via direct request to the WebDAV state directory
vendor_redhat·2026-10-01·CVSS 5.3
CVE-2026-58415 [MEDIUM] CWE-552 httpd: httpd: Information disclosure via direct request to the WebDAV state directory
httpd: httpd: Information disclosure via direct request to the WebDAV state directory
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
A flaw was found in the mod_dav_fs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV (Web Distributed Authoring and Versioning) state directory. This allows unauthorized access to internal state files, resulting in information disclosure of stored resource metadata and pro
GHSA
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties
ghsa_unreviewed·2026-10-01
CVE-2026-58415 [MEDIUM] CWE-552 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory [fedora-all]
bugzilla·2026-10-02·CVSS 5.3
CVE-2026-58415 [MEDIUM] CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory [fedora-all]
CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Bugzilla
CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory
bugzilla·2026-10-01·CVSS 5.3
CVE-2026-58415 [MEDIUM] CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory
CVE-2026-58415 httpd: httpd: Information disclosure via direct request to the WebDAV state directory
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
2026-10-01
Published