Executive brief
The Windows distribution of Apache HTTP Server, when built by Apache Lounge, contains a hardcoded configuration path for OpenSSL that can be hijacked to execute arbitrary code on a local system. An attacker with write access to certain Windows directories could place a malicious openssl.cnf file to gain code execution with the privileges of the Apache process, potentially compromising hosted applications and data.
Technical details
The vulnerability stems from a hardcoded file path in the Apache HTTP Server Windows build that fails to properly validate the location of openssl.cnf before loading it. An attacker with local filesystem write access (such as to C:\, C:\ProgramData, or C:\Windows\TEMP) can place a crafted openssl.cnf file that will be loaded and executed by Apache, resulting in local code execution. This is a file hijacking/DLL preloading variant that arises from insecure path construction and permissive Windows directory permissions.
Affected products
- Apache HTTP Server Windows distribution (Apache Lounge build)
Timeline
- 2026-09-22: disclosed