CVE-2026-24072

Отчет

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires existing privileges to create or modify configuration files on the local web server. Standard Red Hat Enterprise Linux deployments disable directory overrides by default (AllowOverride None), significantly limiting exposure unless an administrator has explicitly enabled them. As a result, the risk is primarily confined to multi-tenant or shared hosting environments where untrusted local users are permitted to author .htaccess directives.

Меры по смягчению последствий

To prevent local users from exploiting this flaw via .htaccess file manipulation, configure Apache HTTP Server to disable .htaccess overrides. Set AllowOverride None within the main server configuration or relevant <Directory> blocks. This restricts the ability of local users to alter server settings. After applying this change, the httpd service must be reloaded or restarted for the new configuration to take effect. Example configuration:

To apply changes, reload the service: sudo systemctl reload httpd Or restart the service: sudo systemctl restart httpd