Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_sessionUpgrade mod_proxy_htmlUpgrade httpd-debuginfoUpgrade mod_mdUpgrade httpd-develUpgrade mod_sslUpgrade httpdUpgrade httpd-manualUpgrade httpd-filesystemUpgrade mod_ldapUpgrade httpd-toolsUpgrade mod_http2 | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade mod_ssl-debuginfoUpgrade httpd-filesystemUpgrade mod_http2Upgrade mod_proxy_htmlUpgrade httpd-core-debuginfoUpgrade mod_sslUpgrade mod_session-debuginfoUpgrade mod_http2-debuginfoUpgrade mod_ldap-debuginfoUpgrade httpd-develUpgrade mod_proxy_html-debuginfoUpgrade mod_sessionUpgrade httpd-toolsUpgrade httpd-debuginfoUpgrade httpd-manualUpgrade mod_ldapUpgrade httpd-coreUpgrade mod_lua-debuginfoUpgrade httpdUpgrade mod_luaUpgrade httpd-tools-debuginfoUpgrade httpd-debugsource | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Redhat_linux | — | No solution exists | Oct 5, 2026 | Oct 1, 2026 |
| Ubuntu | — | Upgrade libapache2-mod-proxy-uwsgiUpgrade apache2-suexec-pristine (Ubuntu Pro)Upgrade libapache2-mod-proxy-html (Ubuntu Pro)Upgrade libapache2-mod-mdUpgrade apache2-ssl-devUpgrade apache2Upgrade apache2 (Ubuntu Pro)Upgrade apache2-mpm-event (Ubuntu Pro)Upgrade libapache2-mod-macro (Ubuntu Pro)Upgrade apache2-mpm-prefork (Ubuntu Pro)Upgrade apache2-devUpgrade apache2-suexec-customUpgrade apache2-utilsUpgrade apache2.2-bin (Ubuntu Pro)Upgrade apache2-utils (Ubuntu Pro)Upgrade apache2-suexec-custom (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgi (Ubuntu Pro)Upgrade apache2-binUpgrade apache2-mpm-itk (Ubuntu Pro)Upgrade apache2-dev (Ubuntu Pro)Upgrade libapache2-mod-md (Ubuntu Pro)Upgrade apache2-suexec (Ubuntu Pro)Upgrade apache2-ssl-dev (Ubuntu Pro)Upgrade apache2-mpm-worker (Ubuntu Pro)Upgrade apache2-suexec-pristineUpgrade apache2-bin (Ubuntu Pro) | Oct 15, 2026 | Oct 14, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub