CVE-2026-24072

Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

Summary

Original description

The description as published by the source.

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.67"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2026-24072 apache2 Fixed in: 2.4.67-r0
Debian DEBIAN-CVE-2026-24072 apache2 Fixed in: 2.4.67-1~deb11u1
Ubuntu UBUNTU-CVE-2026-24072 apache2 Fixed in: 2.4.7-1ubuntu4.22+esm13

References

advisory openwall.com
advisory httpd.apache.org
web nvd.nist.gov