{"id":"CVE-2026-58415","published":"2026-10-01T17:17:29.260","lastModified":"2026-10-05T13:22:10.647","description":"Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-552"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/20","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":null}