CVE-2026-79768: 
Apache HTTP Server Analyse et atténuation de la vulnérabilité

CVE-2026-79768 is a path equivalence vulnerability (CWE-55/CWE-41) in Apache HTTP Server's mod_userdir module, classified as an information disclosure issue. It affects Apache HTTP Server versions 2.4.0 through 2.4.68 when configured with an absolute non-wildcard UserDir directive. The vulnerability was reported on 2026-08-14 by Vlatko Kosturjak of Marlink Cyber, fixed in Apache HTTP Server 2.4.69 on 2026-10-01, and publicly disclosed the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Openwall OSS-Sec).

The root cause is improper resolution of path equivalence (CWE-55, CWE-41): the mod_userdir module fails to normalize or reject URL paths containing a single dot directory segment (/./) before mapping them to user directories. This only applies when UserDir is configured in its absolute non-wildcard form (e.g., UserDir /var/www/users), as documented in the Apache UserDir directive reference. An unauthenticated remote attacker can craft a request using /./ path notation to bypass access controls enforced on user directories, potentially reaching files that should be restricted. The attack maps to CAPEC-3 (Using Leading 'Ghost' Character Sequences to Bypass Input Filters) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated network attacker to read files from user directories that are otherwise access-restricted, resulting in a low confidentiality impact with no integrity or availability impact. The scope is limited to the affected server's user directory content; there is no evidence of lateral movement potential or privilege escalation. The practical risk depends on the sensitivity of files stored in user directories exposed via mod_userdir (GitHub Advisory, Openwall OSS-Sec).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is automatable (no user interaction or privileges required), but exploitation is constrained to servers using the specific absolute non-wildcard UserDir configuration. The EPSS score is approximately 0.32% (0.003240), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify Apache HTTP Server instances (versions 2.4.0–2.4.68) with mod_userdir enabled and configured with an absolute non-wildcard UserDir directive (e.g., UserDir /var/www/users) using tools like Shodan, Censys, or banner grabbing.
2. Identify user directories: Probe for accessible user directories via standard ~username URL patterns (e.g., http://target/~alice/) to confirm mod_userdir is active.
3. Craft path equivalence request: Construct a URL using the /./ single dot directory notation to bypass access controls, for example: http://target/./~alice/restricted-file.txt or http://target/~alice/./restricted-path/.
4. Retrieve restricted content: Submit the crafted request; if the server fails to normalize the path, it may serve files from the user directory that would otherwise be blocked by access control directives.
5. Enumerate further: Iterate over known or guessed filenames within user directories to extract sensitive information such as configuration files, SSH keys, or application secrets (Openwall OSS-Sec, GitHub Advisory).

• Network: HTTP GET requests to Apache server URLs containing /./ path segments targeting user directories (e.g., /./~username/ or /~username/./); unusual access patterns to ~username paths from external IPs.
• Logs: Apache access logs (access_log) showing requests with /./ in the URL path, particularly those returning HTTP 200 responses for paths that should be restricted; repeated probing of multiple ~username paths from a single source IP.
• File System: No direct file system artifacts expected from read-only exploitation; however, review of files accessible via mod_userdir paths for signs of unauthorized access based on last-access timestamps.

Upgrade Apache HTTP Server to version 2.4.69 or later, which includes the fix committed as revision r1938680 on 2026-10-01 (Openwall OSS-Sec). If immediate patching is not possible, review and restrict UserDir configurations — switching from absolute non-wildcard paths to wildcard or disabled configurations reduces exposure. Additionally, implement firewall or WAF rules to block requests containing /./ path sequences targeting user directory URLs, and limit access to mod_userdir-served content to trusted networks where feasible (Red Hat Bugzilla, GitHub Advisory).

The Apache HTTP Server project rated the severity as "low" in the official disclosure by Eric Covener on the oss-security mailing list, crediting Vlatko Kosturjak of Marlink Cyber as the finder (Openwall OSS-Sec). Red Hat opened a tracking bug and classified it as medium severity, with multiple downstream distributions including Amazon Linux, Alpine, Debian, Ubuntu, and Mageia issuing advisories. Coverage appeared in security news outlets including CyberSecurityNews and BleepingComputer in the context of broader Apache HTTP Server 2.4.69 release coverage.