Summary
generated automatically from NVD dataApache HTTP Server 2.4.49 and 2.4.50 contain a path traversal flaw (CWE-22) that remains after the incomplete fix for CVE-2021-41773. An attacker can map URLs to files outside directories set by Alias-like directives, which succeeds when those files lack the "require all denied" protection, and can lead to remote code execution if CGI scripts are enabled for the aliased paths. It is rated CVSS 9.8 (CRITICAL) and is listed in the CISA KEV catalog, with known use in ransomware campaigns.
NVD description
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2021-11-17
Used in known ransomware campaigns.
EPSS · FIRST.org
100.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 7 oct. 2021
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- security@apache.org
Affected products
Weaknesses (CWE)
References (61)
- http://jvn.jp/en/jp/JVN51106450/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2021/10/07/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/1Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/4Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/09/1Mailing ListThird Party Advisory
- + 46 more references on NVD
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.