BIT-apache-2026-29170

vendorUSosv

Apache HTTP Server: mod_proxy_ftp XSS

view advisory published 2026-06-10Licence: per source

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-29170US	—	0.52% (44th)	—	2026-06-08
A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either vi…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/06/08/5ADVISORY
https://httpd.apache.org/security/vulnerabilities_24.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-29170WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan