UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41773

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021.

Severity
Critical 9.8
Published
5 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • Version 2.4.49

Known exploited

CISA name
Apache HTTP Server Path Traversal Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
17 Nov 2021
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41773
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41773