External risk intelligence

Apache HTTP Server mod_dav_fs Path Handling Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-42535

The vulnerability resides in mod_dav_fs, a module used in the Apache HTTP Server. WebDAV is commonly enabled on web servers to facilitate file management and collaboration, often resulting in these endpoints being exposed to the internet as part of a web service or collaborative platform.

Apache Http Server

before 2.4.68

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path handling vulnerability in the Apache HTTP Server's WebDAV module could allow an attacker to manipulate trusted databases, potentially leading to denial-of-service through child process crashes. This issue affects Apache versions prior to 2.4.68.

WebDAV module allows data manipulation, risking crashes.
Important for systems using Apache WebDAV for file sharing.
Confirm relevance; focus on exposure confirmation.

Attack Path

How an attacker could exploit the issue

An attacker could target the Apache HTTP Server's WebDAV functionality, specifically the mod_dav_fs module. If an attacker has the ability to author content via WebDAV, they can manipulate trusted property databases, leading to crashes in child processes.

WebDAV content author access is required.
Manipulating trusted DAV property databases triggers the vulnerability.
Risk of child process crashes.

Live Threat

Current exploitation, exposure, and threat context

A path handling issue in Apache's mod_dav_fs could allow a WebDAV content author to manipulate property databases, potentially leading to child process crashes under certain conditions.

WebDAV property databases at risk.
Authors could manipulate databases.
Service may crash, impacting availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Apache HTTP Server, specifically the `mod_dav_fs` module. Teams responsible for web infrastructure, application hosting, or content management systems that utilize WebDAV should prioritize understanding their exposure. The first step involves identifying all Apache instances running the `mod_dav_fs` module, determining if these instances are externally accessible, and confirming their business criticality. Once identified, the accountable owner must be located to plan remediation.

Web infrastructure and platform teams own this.
Verify externally facing Apache WebDAV deployments.
Plan for upgrades or compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache HTTP Server and mod_dav_fs?

Apache HTTP Server is widely used software that delivers web content to users. The mod_dav_fs component is a specific module within it that adds WebDAV functionality. WebDAV is a set of extensions that allow users to collaboratively edit and manage files directly on the web server, acting like a shared drive over the internet.

What does CWE-668 mean regarding CVE-2026-42535?

CWE-668 refers to a weakness where a resource is exposed to the wrong control sphere. In the context of this CVE, it means the software does not properly restrict access to trusted databases used for storing file properties. Because of this flaw, the system inadvertently allows an unauthorized person to influence or modify files that should have been protected, leading to unintended and potentially disruptive behavior.

How can an attacker trigger this vulnerability?

An attacker triggers this by acting as a content author using the WebDAV interface. By sending specifically crafted requests to manipulate the DAV property databases, they cause the server to process files incorrectly. Simply browsing a website or viewing static content does not trigger this bug; the attacker must have the specific permissions required to author or modify content through the WebDAV protocol.

Is my server at risk if it faces the internet?

According to Halo Surface Signal, instances using mod_dav_fs are frequently exposed to the internet to support file sharing or collaboration. If your Apache server is internet-facing and has WebDAV enabled, the risk is higher because the path to the vulnerable component is reachable by external users. Servers restricted to internal-only networks face a reduced immediate risk from external actors, but the underlying flaw remains.

What should I do to address CVE-2026-42535?

The primary response is to upgrade your Apache HTTP Server installation to version 2.4.68 or later. Before upgrading, verify if your environment uses the mod_dav_fs module. Identify which of these servers are critical to your business operations and check if they are accessible from the internet. Prioritize patching these public-facing systems to eliminate the path handling issue and prevent the potential for service disruptions caused by process crashes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.