Executive brief
The Apache HTTP Server is a widely used web server for hosting websites and applications. A security flaw in its FTP proxy module could allow an attacker to inject malicious scripts into the directory listings shown to users. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in the mod_proxy_ftp module of Apache HTTP Server. The flaw is located in the HTML directory list generation component when the server is configured as a forward or reverse proxy for FTP. An attacker can exploit this by providing crafted FTP directory content that, when rendered as HTML by the proxy, executes malicious JavaScript in the context of the user's browser session. The issue affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-03-04: disclosed: Report received by Apache security team
- 2026-06-04: patched: Fixed in 2.4.x by r1934982
- 2026-06-08: advisory: Public advisory and version 2.4.68 released