CVE-2026-29170: apache software foundation apache http server Cross-site Scripting
Vulnerability summary
CVE-2026-29170 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in apache software foundation apache http server. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 08-06-2026PublishedVulnerability first disclosed.
- 08-06-2026Last modifiedVulnerability information updated.
Description
A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.52 pp
From 0.52% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.68-r0
Apache1 product
- http_server< 2.4.68
Apache software foundation1 product
- apache http server≤ 2.4.67
Debian1 product
- apache2< 2.4.68-1~deb12u1 | < 2.4.68-1~deb13u1 | < 2.4.68-1
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm15 | < 2.4.18-2ubuntu3.17+esm20 | < 2.4.29-1ubuntu4.27+esm11 | < 2.4.41-4ubuntu3.23+esm6 | < 2.4.52-1ubuntu4.23 | < 2.4.58-1ubuntu8.15 | All versions (No fix recorded) | < 2.4.66-2ubuntu2.4
5 vendors · 5 products
