Apache HTTP Server Path Traversal Vulnerability

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• alpine apache22.4.50-r0
• cpe apache/http server2.4.49
• cpe fedoraproject/fedora34
• cpe fedoraproject/fedora35
• cpe netapp/cloud backupversion unspecified
• cpe oracle/instantis enterprisetrack17.1
• cpe oracle/instantis enterprisetrack17.2
• cpe oracle/instantis enterprisetrack17.3
• vendor Apache HTTP Serverversion unspecified

How to fix CVE-2021-41773

• Recommended remediation

  Apply updates per vendor instructions. CISA due date Nov 17, 2021.

• Official advisories

  • Alpine Linux Security · security.alpinelinux.org
  • CISA KEV · cisa.gov
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • NIST NVD · nvd.nist.gov
  • Packet Storm Security · packetstormsecurity.com

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 5, 2021 · Catalog

   Detected

   A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these ali

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these ali

Sources

• Alpine Linux SecurityPackage advisoryCVE-2021-41773

  CVE-2021-41773 is fixed in Alpine edge package apache2 2.4.50-r0 (main).

  security.alpinelinux.org
• CISA KEVConfirmed exploitationCVE-2021-41773

  Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.

  cisa.gov
• CVE.orgVulnerability recordCVE-2021-41773

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2021-41773

  30-day exploitation probability 100.0%

  first.org
• Exploit DatabasePublic exploit reference50383

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference50512

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleauxiliary_scanner/http/apache_normalize_path

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• Metasploit ModulesPublic exploit moduleexploit_multi/http/apache_normalize_path_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2021-41773

  A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usu

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• VulnCheck KEVConfirmed exploitationCVE-2021-41773

  Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued

  vulncheck.com

References

• Exploit · packetstormsecurity.com
• Exploit · packetstormsecurity.com
• Exploit · packetstormsecurity.com
• Exploit · packetstormsecurity.com
• Mailing List · openwall.com
• Mailing List · openwall.com
• VulnCheck exploitation evidence · api.vulncheck.com
• VulnCheck exploitation evidence · docs.google.com
• Release Notes · httpd.apache.org
• CISA note · nvd.nist.gov
• VulnCheck exploitation evidence · unit42.paloaltonetworks.com
• VulnCheck exploitation evidence · cisa.gov
• VulnCheck exploitation evidence · countercraftsec.com
• VulnCheck exploitation evidence · cve.org

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.