CVE-2026-29170 Apache HTTP Server: mod_proxy_ftp XSS

What is CVE-2026-29170?

CVE-2026-29170 is a medium-severity cross-site scripting vulnerability in Apache Http Server, published on 8 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Weakness: CWE-79

Which versions are affected by CVE-2026-29170?

1 open source package ship an affected version, including apache. It affects 1 product.

Products include Apache Http Server.

How do I fix CVE-2026-29170?

Upgrade apache to 2.4.68 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-29170 being exploited?

There is no known exploitation of CVE-2026-29170 in the wild and no public exploit code.

Other vulnerabilities in Apache Http Server

• CVE-2021-42013 Apache HTTP Server Path Traversal Exploited Critical 9.8
• CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Exploited Critical 9.1
• CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) Exploited Critical 9.0
• CVE-2019-0211 Apache HTTP Server Privilege Escalation Exploited High 7.8
• CVE-2021-41773 Apache HTTP Server Path Traversal Exploited High 7.5

All Apache Http Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-29170, AZL-89723, BELL-CVE-2026-29170, BIT-apache-2026-29170, DEBIAN-CVE-2026-29170, ECHO-22e1-03d3-bb43 and 3 more.