Security : CVE-2026-24072 : Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

An escalation-of-privilege bug in various modules in Apache HTTP Server 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

High 2026-09-08

CloudLinux cPanel Imunify360

Default Update CMD

sudo /scripts/upcp --force

Situation

An escalation-of-privilege bug in various modules in Apache HTTP Server 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Impact

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

We have pushed out a patch for the following additional CVE’s:

You can find more information on all of the above in our Change Logs: Easy Apache 4 Change logs

Call to Action

AlmaLinux

Please run the following command to update EasyApache 4:

# dnf clean all

# dnf makecache

# dnf -y update ea-apache*

CloudLinux

Please run the following command to update EasyApache 4:

# yum update ea-apache24 –enablerepo=cl-ea4-testing

Imunify360

Please run the following command to update EasyApache 4:

# yum update ea-apache24 –enablerepo=imunify360-ea-php-hardened-beta

Ubuntu

Please run the following command to update EasyApache 4:

# apt update

# apt install –only-upgrade “ea-apache24*”

How to Apply the Fix

Update the affected packages on your server to the patched release, then restart the relevant services.

sudo /scripts/upcp --force

References

Vendor Advisory

Security Advisories

Related Advisories

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation

2026-09-08

Security: CVE-2026-58048 Database Privilege Escalation

2026-09-08

Check your system for vulnerabilities

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

Check Your System