CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache HTTP Server and 4 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by Nov 17, 2021, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
- CVSS
- 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Added to CISA KEV Nov 3, 2021; federal remediation due Nov 17, 2021; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 99.99% (percentile 100)
- Assigned by
- apache
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache HTTP Server apache_software_foundation:apache_http_server (from the name) | Apache HTTP Server 2.4 2.4.49 | CNA record |
apache http_server apache:http_server | 2.4.49 | NVD |
fedoraproject fedora fedoraproject:fedora | 34; 35 | NVD |
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack | 17.1; 17.2; 17.3 | NVD |
netapp cloud_backup netapp:cloud_backup | all versions | NVD |
References
- https://httpd.apache.org/security/vulnerabilities_24.htmlx-refsource-misc, release-notes, vendor-advisory
- https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3Emailing-list, x-refsource-mlist
- http://www.openwall.com/lists/oss-security/2021/10/05/2mailing-list, x-refsource-mlist, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/07/1mailing-list, x-refsource-mlist, third-party-advisory
- https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3Emailing-list, x-refsource-mlist
- http://www.openwall.com/lists/oss-security/2021/10/07/6mailing-list, x-refsource-mlist, third-party-advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZvendor-advisory, x-refsource-cisco
- http://www.openwall.com/lists/oss-security/2021/10/08/1mailing-list, x-refsource-mlist, exploit, third-party-advisory
- https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3Emailing-list, x-refsource-mlist, patch
- http://www.openwall.com/lists/oss-security/2021/10/08/2mailing-list, x-refsource-mlist, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/3mailing-list, x-refsource-mlist, exploit, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/4mailing-list, x-refsource-mlist, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/6mailing-list, x-refsource-mlist, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/5mailing-list, x-refsource-mlist, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/09/1mailing-list, x-refsource-mlist, third-party-advisory
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- http://www.openwall.com/lists/oss-security/2021/10/11/4mailing-list, x-refsource-mlist, patch, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/vendor-advisory, x-refsource-fedora, release-notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/vendor-advisory, x-refsource-fedora, release-notes
- http://www.openwall.com/lists/oss-security/2021/10/15/3mailing-list, x-refsource-mlist, patch, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/10/16/1mailing-list, x-refsource-mlist, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.