CVE-2026-29170

score

<0.1

cvss

6.1

epss

1.0%

published

2026-06-08

kev added

—

first seen

2026-10-21

Apache HTTP Server <= 2.4.67 contains a stored XSS vulnerability caused by unsafe HTML directory list generation in mod_proxy_ftp when listing FTP directory contents via proxy, letting remote attackers execute scripts, exploit requires no special privileges.