Summary
generated automatically from NVD dataApache HTTP Server 2.4.49 contains a path traversal flaw (CWE-22) introduced by a change in path normalization, letting an attacker map URLs to files outside directories set by Alias-like directives. Requests succeed if those files lack the default "require all denied" protection, and with CGI enabled for the aliased paths it could lead to remote code execution. It is rated CRITICAL (CVSS 9.8) and is listed in the CISA KEV catalog as exploited, including in ransomware campaigns; the 2.4.50 fix was found incomplete (see CVE-2021-42013).
NVD description
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2021-11-17
Used in known ransomware campaigns.
EPSS · FIRST.org
100.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 5 oct. 2021
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- security@apache.org
Affected products
Weaknesses (CWE)
References (59)
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2021/10/05/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/07/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/07/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/1ExploitMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/3ExploitMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/4Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/09/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/11/4Mailing ListPatchThird Party Advisory
- + 44 more references on NVD
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.