Quick Start

• Read the full analysis: CVE-2026-24072-analysis.md
• View the patches: mod_rewrite.diff, mod_setenvif.diff, mod_proxy_fcgi.diff
• See proof-of-concept examples: examples/

Root Cause

Apache's expression evaluation engine (ap_expr) provides filesystem introspection functions:

• file(path) — reads file contents
• filesize(path) — returns file size
• -d path, -e path, -f path, -s path, -L path, -h path, -x path — filesystem tests

In 2.4.66 and earlier, modules such as mod_rewrite (via RewriteCond expr=...), mod_setenvif (via SetEnvIfExpr), and mod_proxy_fcgi (via ProxyFCGIBackendType condition expressions) would parse and evaluate ap_expr expressions without passing the AP_EXPR_FLAG_RESTRICTED flag when operating in .htaccess context. This meant that any local user who could write a .htaccess file could use these expression functions to probe or read the filesystem with the full privileges of the httpd process.

The Fix

The fix is conceptually simple: when parsing ap_expr expressions in .htaccess context, pass the AP_EXPR_FLAG_RESTRICTED flag.

All three patched modules use the same idiom to detect .htaccess parsing context:

When Apache parses .htaccess files, the per-directory configuration pool (cmd->pool) is the same as the temporary pool (cmd->temp_pool). This is a well-known internal Apache convention for detecting .htaccess (per-directory) context vs. main server/virtual host context.

Files in this Repository

Verifying the Patch

This repository includes a Dockerized testing lab that lets you swap between the vulnerable and patched mod_rewrite modules to verify the fix works:

The lab uses a sentinel file (/opt/sentinel/secret.txt) that is readable only by the daemon user (the user httpd runs as). On the vulnerable build, .htaccess expressions can read and match the sentinel's contents. On the fixed build, parsing fails with not available in restricted context.

See docs/TESTING.md for the full guide.

Files in this Repository

References

• CVE-2026-24072 - Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
• Apache HTTP Server 2.4 Security Vulnerabilities
• cPanel Security Advisory for CVE-2026-24072

Disclaimer

This repository is for educational and defensive purposes only. The proof-of-concept examples are intended to help security professionals understand and defend against this vulnerability. Do not use these techniques on systems you do not own or have explicit permission to test.