CVE-2021-41773
Apache HTTP Server Path Traversal Vulnerability
Published Oct 5, 2021 · updated Jun 16, 2026 · apache http server
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 5, 2021 · Catalog
Detected
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these ali
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these ali
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe apache/http server2.4.49
- cpe fedoraproject/fedora34
- cpe fedoraproject/fedora35
- cpe netapp/cloud backupversion unspecified
- cpe oracle/instantis enterprisetrack17.1
- cpe oracle/instantis enterprisetrack17.2
- cpe oracle/instantis enterprisetrack17.3
- vendor Apache HTTP Serverversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-41773
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
cisa.gov - CVE.orgVulnerability recordCVE-2021-41773
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-41773
30-day exploitation probability 100.0%
first.org - Exploit DatabasePublic exploit reference50383
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference50512
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleauxiliary_scanner/http/apache_normalize_path
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - Metasploit ModulesPublic exploit moduleexploit_multi/http/apache_normalize_path_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2021-41773
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usu
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com