Apache HTTP Server privilege escalation through expressions (CVE-2026-24072)

Summary

Local .htaccess authors may read files using the HTTP server account's privileges.

Vulnerability ID	Vulnerability Overview
CVE-2026-24072	Expression handling in affected Apache modules can let a user who controls .htaccess access files beyond that user's intended permissions, using the privileges of the httpd process.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices