CVE-2026-79768

A flaw was found in Apache HTTP Server's mod_userdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory ('/./') path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP request, potentially bypassing path restrictions to access unauthorized files, leading to information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable user directories or avoid configuring absolute directory paths without wildcards in the UserDir directive.

1. If per-user web directories are not required, ensure UserDir disabled is configured in /etc/httpd/conf.d/userdir.conf, or comment out the module loading directive:

# LoadModule userdir_module modules/mod_userdir.so

2. If user directories are necessary, configure UserDir using a relative path (for example, UserDir public_html) rather than an absolute path.

3. Reload the Apache HTTP Server configuration to apply changes:

systemctl reload httpd

Caveats: Disabling mod_userdir prevents users from publishing content via ~username URLs. Reloading the httpd service may briefly affect active HTTP connections.