A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/08/5 | Mailing List Third Party Advisory |
Configurations
History
09 Jun 2026, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | |
| First Time |
Apache http Server
Apache |
|
| References | () https://httpd.apache.org/security/vulnerabilities_24.html - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/08/5 - Mailing List, Third Party Advisory |
08 Jun 2026, 23:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
08 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-08 16:16
Updated : 2026-06-09 16:21
NVD link : CVE-2026-29170
Mitre link : CVE-2026-29170
CVE.ORG link : CVE-2026-29170
JSON object : View
Products Affected
apache
- http_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')