CVE-2026-42535

What it actually does

Apache HTTP Server 2.4.67 and earlier contains a path handling flaw in mod_dav_fs, the filesystem-backed WebDAV module. A specially crafted WebDAV authoring request can cause Apache to resolve paths in a way that lets a WebDAV content author directly manipulate trusted DAV property database files rather than only the intended content resources. Successful exploitation can corrupt or alter WebDAV metadata and may crash Apache child processes, causing integrity and availability impact. Exposure generally requires WebDAV/mod_dav_fs to be enabled on a writable location; authentication depends on how that WebDAV location is configured.

Why it matters to the business

Organizations running Apache HTTP Server with WebDAV enabled may experience website or file-publishing disruption, service instability, and unauthorized alteration of WebDAV metadata. Repeated crashes of Apache child processes can degrade availability or cause outages for affected web services. The CVSS score is high, but current public exploitation signals are low: EPSS is 0.00538 with no 30-day increase, it is not currently in CISA KEV, and no mature public exploit is indicated. Systems exposed to untrusted WebDAV authors should still be prioritized because exploitation is network-reachable and low-complexity once a writable WebDAV endpoint is available.

How an attack unfolds

An attacker first identifies an Apache HTTP Server instance exposing WebDAV functionality, usually by observing allowed WebDAV methods such as PROPFIND, PROPPATCH, MKCOL, PUT, MOVE, COPY, LOCK, or UNLOCK. If the WebDAV location allows anonymous authoring, the attacker can proceed directly; otherwise they use valid author credentials or a compromised account. The attacker then sends crafted WebDAV requests containing malicious path components intended to confuse mod_dav_fs path resolution. Instead of operating only on the requested WebDAV resource, the vulnerable module can allow interaction with trusted DAV property database files. The attacker uses this to corrupt or manipulate DAV properties and may intentionally trigger malformed state that causes Apache child processes to crash. Repeating the request can create a denial-of-service condition and may also alter WebDAV metadata used by clients or applications.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or a vendor-supported package that includes the backported fix. Where immediate upgrade is not possible, disable WebDAV and unload mod_dav_fs if it is not required. If WebDAV is required, restrict it to trusted authenticated users, avoid anonymous authoring, limit authoring methods to the minimum required, and ensure filesystem permissions prevent the web server process from writing outside intended DAV storage areas. Add reverse proxy or WAF controls to block path traversal patterns in WebDAV methods as a temporary compensating control. After patching or configuration changes, fully restart Apache so all worker processes run the fixed code.

How to confirm the fix worked

Confirm the running Apache HTTP Server version is 2.4.68 or later, or verify the installed operating system package changelog includes the vendor backport for this issue. Check loaded modules with commands such as `apachectl -M` or `httpd -M` and confirm whether `dav_module` and `dav_fs_module` are enabled. Review Apache configuration for `DAV On`, `DavLockDB`, WebDAV-enabled `<Location>` or `<Directory>` blocks, and write permissions on DAV content roots. Validate that untrusted users cannot perform WebDAV authoring methods unless explicitly required. Use a non-destructive WebDAV client or OPTIONS request to verify exposed methods, and confirm malformed traversal-style WebDAV requests are rejected without Apache child process crashes or unexpected 5xx spikes.

Typical attack path

1. Discover an Apache HTTP Server endpoint that has WebDAV enabled.
2. Enumerate supported methods using OPTIONS or WebDAV-specific requests such as PROPFIND.
3. Determine whether authoring is anonymous or requires valid credentials.
4. Send crafted WebDAV authoring requests with path traversal or path-confusion components against a writable DAV location.
5. Cause mod_dav_fs to operate on trusted DAV property database files instead of only normal content paths.
6. Modify or corrupt DAV property data and observe 5xx responses, worker crashes, or service instability.
7. Repeat the request to sustain denial of service or further tamper with WebDAV metadata.

How to detect it

Review Apache access logs, reverse proxy logs, WAF logs, and Apache error logs for evidence of suspicious WebDAV activity before patching. Focus on WebDAV authoring methods such as PROPPATCH, PUT, MKCOL, MOVE, COPY, LOCK, and UNLOCK that include traversal sequences, encoded dot-dot patterns, encoded slashes, unusual references to DAV metadata directories, or requests immediately followed by HTTP 500 responses. In error logs, look for Apache child process crashes, segmentation faults, aborted workers, or sudden worker recycling after WebDAV requests. Correlate suspicious requests by timestamp, client IP, authenticated WebDAV username if available, request URI, response code, and worker crash messages. On hosts, inspect WebDAV content directories for unexpected changes to hidden DAV property metadata, abnormal file ownership or modification times, and recently modified DAV property database files. Because no public mature exploit or known threat actor campaign is indicated, detection should be behavior-based rather than relying on a single known payload.

• PROPPATCH
• PROPFIND
• MKCOL
• LOCK
• UNLOCK
• MOVE
• COPY
• PUT
• ../
• ..%2f
• %2e%2e
• %252e%252e
• %2f..%2f
• %5c..%5c
• .DAV
• /.DAV/
• DavLockDB
• child pid
• exit signal Segmentation fault
• Segmentation fault
• AH00052: child pid
• HTTP/1.1" 500
• "PROPPATCH
• "PUT
• "MKCOL
• "MOVE
• "COPY

What your security team should do

• Inventory internet-facing and internal Apache HTTP Server instances and identify where WebDAV/mod_dav_fs is enabled.
• Prioritize upgrade of WebDAV-enabled Apache servers to 2.4.68 or a vendor-fixed build, especially where authoring is exposed to untrusted users.
• Disable WebDAV entirely where it is not a business requirement.
• Remove anonymous WebDAV write access and require strong authentication for all authoring operations.
• Restrict allowed WebDAV methods and enforce least-privilege filesystem permissions on DAV content directories and property storage.
• Add temporary WAF or reverse-proxy rules for traversal sequences in WebDAV methods until patching is complete.
• Monitor Apache access and error logs for WebDAV methods containing traversal encodings, direct references to DAV metadata paths, repeated 4xx/5xx responses, and child process crashes.
• Review recent WebDAV activity for unusual PROPPATCH, PUT, MOVE, COPY, MKCOL, LOCK, or UNLOCK requests from unfamiliar sources.