Medium severity6.1NVD Advisory· Published Jun 8, 2026· Updated Jun 9, 2026
CVE-2026-29170
CVE-2026-29170
Description
A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*range: <2.4.68
- (no CPE)range: <=2.4.67
- Range: <=2.4.67
Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/06/08/5nvdMailing ListThird Party Advisory
- httpd.apache.org/security/vulnerabilities_24.htmlnvdVendor Advisory
News mentions
3- Apache HTTP Server and Answer: 22 Vulnerabilities Disclosed, Including Critical FlawsVypr Intelligence · Jun 10, 2026
- Apache HTTP Server 2.4.68 Released With Fix For Use-After-Free, DoS, XSS, and Buffer Overflow FlawsCyber Security News · Jun 9, 2026
- Apache HTTP Server: 11 Vulnerabilities Disclosed, Including DoS and Memory Corruption FlawsVypr Intelligence · Jun 8, 2026