CVE-2008-0455: Apache mod_negotiation XSS via crafted uploaded filename

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw requires authentication to upload the malicious file and victim interaction to trigger, and CVSS rates it 4.3, though public exploit references and a high EPSS score raise its practical risk.

What it is

Apache HTTP Server's mod_negotiation module reflects attacker-controlled filenames into 406 Not Acceptable and 300 Multiple Choices error responses without proper encoding. An authenticated user who can upload a file with XSS sequences in its name can inject script or HTML that executes in the browser of anyone requesting that file without its extension. The flaw affects the 2.2.x, 2.0.x and 1.3.x series up to the versions named in the record.

Impact

An attacker gains script execution in the victim's browser session on the affected server's origin, enabling session theft, request forgery or content manipulation. The CVSS 2.0 vector shows integrity impact only, with no confidentiality or availability impact.

Attack surface

Reached over the network through normal HTTP requests to a file served by mod_negotiation; the injection triggers when a request omits the file extension. The record states remote authenticated users are required to upload the maliciously named file, and a victim must then request that file for the script to run.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.6477 (99.2nd percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Upgrade Apache HTTP Server to a release later than the affected 2.2.x, 2.0.x and 1.3.x versions named in the record, or apply the vendor errata referenced (RHSA-2012-1591/1592/1594, RHSA-2013-0130, GLSA-200803-19).
• Disable or restrict mod_negotiation (MultiViews) where content negotiation is not required.
• Restrict file upload privileges so untrusted users cannot place files with attacker-controlled names on the web root.
• Encode or sanitize filenames before they are reflected into error responses, and enforce a strict filename character policy.
• Deploy a WAF or response filter that blocks script content in 300 and 406 responses.

Detection

• Search web server logs for 300 and 406 responses tied to requests for files whose names contain script or HTML metacharacters.
• Audit uploaded filenames on the web root for angle brackets, quotes or script sequences.
• Monitor for requests that omit file extensions on negotiated resources, which is the trigger condition.
• Review mod_negotiation and MultiViews configuration across servers to confirm exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.