CVE-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access

Synopsis

An authentication bypass and path-handling flaw in mod_dav_fs in Apache HTTP Server 2.4.67 and earlier allows a remote, unauthenticated attacker to directly manipulate trusted DAV property databases. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation lets an attacker corrupt or overwrite DAV property stores and crash Apache child processes, causing service disruption and data tampering. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable mod_dav_fs endpoint is exposed over the network, meaning an attacker must be able to send HTTP or WebDAV requests to the server.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, so any unauthenticated client can attempt exploitation.

• Victim interactionNot required

  The attack is fully server-side; no user or administrator needs to click, open, or approve anything for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• Attacker writes or overwrites DAV property database files in directories that should be protected, corrupting stored WebDAV metadata.
• Attacker triggers crashes in Apache HTTP Server child processes, degrading or fully disrupting service availability for all clients hitting the affected instance.
• Persistent corruption of DAV property stores can cause follow-on failures in any application or workflow that relies on WebDAV properties stored by mod_dav_fs.