Path Equivalence Vulnerability in Apache HTTP Server's mod_userdir Module
Summary
ALPINE-CVE-2026-79768: Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/... Affects apache2 versions < 2.4.69-r0. Fixed in 2.4.69-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely-used open-source web server software that enables the hosting of websites and applications. The mod_userdir module allows users to access their personal web directories. This module is crucial for shared hosting environments, providing users with the ability to host their content without needing administrative access. However, a vulnerability exists in this module when configured with an absolute non-wildcard UserDir directive, which can lead to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-79768, arises from a path equivalence issue involving the use of the './' (single dot directory) notation. When the mod_userdir module is improperly configured, it may allow unauthorized access to user directories, potentially exposing sensitive information. This vulnerability affects Apache HTTP Server versions from 2.4.0 to 2.4.68, making it critical for users to address it promptly to prevent exploitation.
How To Fix
Minimum fixed version
2.4.69-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify their UserDir configuration to avoid using absolute non-wildcard directives, thereby mitigating the risk until the server can be updated. For example, consider using a wildcard UserDir directive or disabling the mod_userdir module if not needed.
Conclusion
The path equivalence vulnerability in Apache HTTP Server's mod_userdir module poses a significant risk to users who have not updated their software. By understanding the nature of this vulnerability and taking the necessary steps to update or configure the server properly, users can protect their applications from potential exploitation.
See every vulnerability recorded for apache2 →
FAQ
CVE-2026-79768 is a vulnerability in the Apache HTTP Server's mod_userdir module that allows unauthorized access to user directories due to improper configuration.
The vulnerability affects Apache HTTP Server versions from 2.4.0 through 2.4.68.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Update your Apache HTTP Server to version 2.4.69-r0 or later and review your UserDir configurations to ensure they are secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
