CVE-2026-24072

A flaw was found in Apache HTTP Server. This escalation of privilege vulnerability allows local attackers, specifically those with the ability to author .htaccess files, to read sensitive files. This flaw enables unauthorized access to files with the privileges of the httpd user, potentially leading to information disclosure.

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires existing privileges to create or modify configuration files on the local web server. Standard Red Hat Enterprise Linux deployments disable directory overrides by default (AllowOverride None), significantly limiting exposure unless an administrator has explicitly enabled them. As a result, the risk is primarily confined to multi-tenant or shared hosting environments where untrusted local users are permitted to author .htaccess directives.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent local users from exploiting this flaw via .htaccess file manipulation, configure Apache HTTP Server to disable .htaccess overrides. Set AllowOverride None within the main server configuration or relevant <Directory> blocks. This restricts the ability of local users to alter server settings. After applying this change, the httpd service must be reloaded or restarted for the new configuration to take effect.

Example configuration:

<Directory "/var/www/html">
    AllowOverride None
</Directory>

To apply changes, reload the service: sudo systemctl reload httpd Or restart the service: sudo systemctl restart httpd