CVE-2017-15715: Apache httpd FilesMatch regex bypass via trailing newline in filename

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (8.1) and a very high EPSS score indicate likely exploitation, though the flaw only affects environments using trailing-portion FilesMatch upload blocks and it is not in KEV.

What it is

In Apache httpd 2.4.0 through 2.4.29, the regular expression in a <FilesMatch> directive could match '$' against a newline character embedded in a malicious filename instead of only the true end of the filename. This lets an attacker craft a filename that fails a trailing-portion block rule while still being accepted by the server, undermining upload restrictions that rely on FilesMatch.

Impact

An attacker can bypass filename-based upload blocks and get a file past the intended restriction, potentially leading to code execution or other compromise depending on what the server does with the uploaded file. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached remotely over the network by submitting a crafted filename, typically through a file upload endpoint. No authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N), though the flaw only matters where FilesMatch is used to block uploads by trailing filename portion.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high at 0.85452 (99.7th percentile), indicating strong predicted exploitation activity; references are advisories and mailing-list posts, with no public exploit tag in the record.

What to do

• Upgrade Apache httpd to a version after 2.4.29 that fixes the FilesMatch newline handling.
• Apply vendor errata for downstream packages (Red Hat RHSA-2018:3558, RHSA-2019:0366, RHSA-2019:0367; Ubuntu USN-3627-1 and USN-3627-2).
• Replace trailing-portion FilesMatch block rules with validation that rejects filenames containing newline or control characters.
• Normalize and sanitize uploaded filenames before any policy check, and enforce upload restrictions at the application layer rather than relying solely on httpd regex matching.

Detection

• Search httpd access and error logs for filenames containing encoded or literal newline characters (%0a) in upload requests.
• Audit httpd configuration for <FilesMatch> directives that match only the trailing portion of a filename and review what they are meant to block.
• Monitor for uploaded files whose names end in unexpected extensions or control characters, and alert on writes to web-accessible upload directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.