CVE-2026-24072 — Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

CVE-2026-24072

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr PUBLISHED

Description (CNA)

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache HTTP Server	affected 0 through 2.4.66

CWE

CWE-269

References

https://httpd.apache.org/security/vulnerabilities_24.html

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/05/04/18

CISA-ADP

No English description supplied.

No references supplied.