CVE-2026-29170

A flaw was found in Apache HTTP Server, specifically within the mod_proxy_ftp module. This cross-site scripting (XSS) vulnerability occurs during the generation of HTML directory lists when the server is configured to list FTP directory contents via either a forward or reverse proxy. An attacker could exploit this by injecting malicious scripts into web pages, which could lead to information disclosure or unauthorized actions when viewed by other users.

This Moderate impact cross-site scripting (XSS) vulnerability in Apache HTTP Server's mod_proxy_ftp module requires specific server configurations to be exploitable. The flaw occurs when mod_proxy_ftp is enabled and configured to list FTP directory contents via a proxy, which is not a default setup in Red Hat Enterprise Linux. Successful exploitation depends on a user viewing a specially crafted web page, potentially leading to information disclosure or unauthorized actions within the user's browser context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.