Executive brief
Apache HTTP Server is a widely used web server for hosting websites and applications. A security flaw allows individuals with the ability to upload or edit .htaccess configuration files to bypass security restrictions and read sensitive files they should not have access to. This could lead to the exposure of private data or system configuration files, potentially compromising the entire server.
Technical details
An improper privilege management vulnerability (CWE-269) exists in Apache HTTP Server versions 2.4.0 through 2.4.67. The flaw is rooted in how expressions are handled within .htaccess files across multiple modules. A local attacker with the ability to author .htaccess files can leverage these expressions to read arbitrary files on the system using the privileges of the 'httpd' service user, bypassing intended access controls. This effectively results in a local privilege escalation from a restricted content author to the service account level. The issue is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-05-05: disclosed: Reported to Apache security team
- 2026-06-05: patched: Fixed in development branch
- 2026-06-08: advisory: Public advisory and version 2.4.68 released