Path Equivalence Vulnerability in Apache HTTP Server's mod_userdir Module
Summary
DEBIAN-CVE-2026-79768: Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/... Affects apache2 versions 2.4.57-2 – 2.4.69-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and applications. The mod_userdir module allows users to access their personal web directories, providing a convenient way to host user-specific content. However, a vulnerability has been identified in this module when configured with an absolute non-wildcard UserDir directive, which can lead to unauthorized access due to path equivalence issues.
Vulnerability Detail
The vulnerability, identified as CVE-2026-79768, arises from the handling of path equivalence in the mod_userdir module of Apache HTTP Server. Specifically, the use of the './' (single dot directory) can allow attackers to bypass security restrictions, potentially leading to unauthorized access to sensitive files. This issue affects versions of Apache HTTP Server from 2.4.0 through 2.4.68, posing a risk to users who have configured the UserDir directive improperly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can modify their configuration to avoid using the absolute non-wildcard UserDir directive. Instead, consider using a wildcard or relative path configuration to mitigate the risk until an upgrade can be performed.
Conclusion
The path equivalence vulnerability in the Apache HTTP Server's mod_userdir module poses a significant risk to users who have not properly configured their directives. It is crucial to update to the latest version to mitigate this risk and ensure the security of web applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2026-79768 is a vulnerability in the Apache HTTP Server's mod_userdir module that allows unauthorized access due to path equivalence issues.
The vulnerability affects Apache HTTP Server versions from 2.4.0 through 2.4.68.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If an immediate upgrade is not possible, consider implementing the recommended workaround by adjusting your UserDir directive configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
