CVE-2026-58415
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation…
- Risk score
- 51/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: fro…
- Affected
- Apache Http Server before 2.4.69
- Fix
- Upgrade Apache Http Server to 2.4.69 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: apache http server
References
Original description
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Last activity 1 Oct 2026. Patch Forecast updates every hour.