CVE-2001-0925: Apache HTTP Server path handling flaw exposes directory listings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw is remotely exploitable without authentication and has very high EPSS, but it only discloses directory listings and affects a long-obsolete Apache version.

What it is

Apache HTTP Server before 1.3.19 mishandles request paths containing many slash characters, causing mod_negotiation, mod_dir, or mod_autoindex to serve a directory listing instead of the intended multiview index.html. This is a default-installation information disclosure issue that can reveal files not meant to be browsable.

Impact

A remote attacker can enumerate directory contents that the server configuration intended to hide behind a multiview index page, exposing filenames and directory structure. There is no integrity or availability impact; only confidentiality is affected.

Attack surface

Reachable over the network via a crafted HTTP request containing an excessive number of slash characters in the path. No authentication or user interaction is required, as reflected by the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but public exploit-tagged references exist and EPSS is very high (0.75238, 99.487th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Apache HTTP Server to 1.3.19 or later, or apply the vendor patch referenced in the Apache and Debian advisories.
• Disable directory listing by removing Indexes from Options in httpd.conf for directories that should not be browsable.
• Ensure multiview index files are correctly configured and test paths with repeated slashes to confirm the intended index is served.
• Restrict access to sensitive directories with authentication or network controls as a compensating measure where patching is delayed.

Detection

• Search web server access logs for request URIs containing unusually long runs of consecutive slash characters.
• Alert on HTTP 200 responses returning directory index pages for paths that normally resolve to an index.html.
• Monitor for repeated directory-listing requests from a single source, which may indicate enumeration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.