A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Jul 7, 2026 | Jun 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_ldapUpgrade httpd-manualUpgrade httpd-filesystemUpgrade mod_sessionUpgrade mod_sslUpgrade httpd-toolsUpgrade mod_proxy_htmlUpgrade httpdUpgrade httpd-debuginfoUpgrade httpd-develUpgrade mod_md | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade httpd-debugsourceUpgrade mod_sslUpgrade mod_proxy_html-debuginfoUpgrade httpd-filesystemUpgrade mod_ldapUpgrade httpd-core-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_sessionUpgrade mod_lua-debuginfoUpgrade httpd-manualUpgrade mod_luaUpgrade mod_session-debuginfoUpgrade httpd-coreUpgrade httpd-develUpgrade mod_ssl-debuginfoUpgrade mod_proxy_htmlUpgrade httpdUpgrade httpd-toolsUpgrade httpd-debuginfoUpgrade mod_ldap-debuginfo | Jun 23, 2026 | Jun 8, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Jun 9, 2026 | Jun 8, 2026 |
| Debian | — | Upgrade apache2 | Jun 16, 2026 | Jun 16, 2026 |
| Freebsd | — | Upgrade apache24 | Jun 15, 2026 | Jun 8, 2026 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Aug 16, 2026 | Aug 13, 2026 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.29 or laterApply IBM HTTP Server version 8.5.5.30 or laterApply IBM HTTP Server Interim Fix PH71594 | Jun 17, 2026 | Jun 16, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jun 8, 2026 |
| Ubuntu | — | Upgrade apache2-mpm-worker (Ubuntu Pro)Upgrade apache2-mpm-event (Ubuntu Pro)Upgrade libapache2-mod-proxy-html (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgi (Ubuntu Pro)Upgrade apache2-suexec-pristine (Ubuntu Pro)Upgrade apache2 (Ubuntu Pro)Upgrade apache2-utils (Ubuntu Pro)Upgrade apache2-dev (Ubuntu Pro)Upgrade apache2-mpm-prefork (Ubuntu Pro)Upgrade apache2-bin (Ubuntu Pro)Upgrade apache2Upgrade apache2-ssl-dev (Ubuntu Pro)Upgrade apache2.2-bin (Ubuntu Pro)Upgrade apache2-mpm-itk (Ubuntu Pro)Upgrade apache2-suexec (Ubuntu Pro)Upgrade libapache2-mod-macro (Ubuntu Pro)Upgrade apache2-suexec-custom (Ubuntu Pro)Upgrade libapache2-mod-md (Ubuntu Pro) | Jul 9, 2026 | Jul 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub