CVE-2026-58415

A flaw was found in the mod_dav_fs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV (Web Distributed Authoring and Versioning) state directory. This allows unauthorized access to internal state files, resulting in information disclosure of stored resource metadata and properties.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, block direct HTTP requests to the internal WebDAV state directory, or disable the mod_dav_fs module if WebDAV functionality is not required.

1. Block access to the .DAV directory: Create or edit a configuration snippet, such as /etc/httpd/conf.d/block-dav-state.conf, with the following directive:

<LocationMatch "(^|/).DAV"> Require all denied </LocationMatch>

2. Alternatively, disable the module if WebDAV is not used: Comment out the following line in /etc/httpd/conf.modules.d/00-dav.conf:

LoadModule dav_fs_module modules/mod_dav_fs.so

3. Apply changes: Verify the configuration syntax:

apachectl configtest

Reload the service:

systemctl reload httpd

Warning: Reloading or restarting httpd will impact active network connections. Ensure configuration syntax is validated before reloading to avoid service interruption. Disabling mod_dav_fs will stop all WebDAV filesystem storage operations.