Vulnerability record · CVE-2021-41773 · published 5 October 2021
CVE-2021-41773: Apache HTTP Server 2.4.49 path traversal and RCE
Apache · Http Server
A path normalization flaw introduced in Apache HTTP Server 2.4.49 lets attackers map URLs to files outside directories configured by Alias-like directives. If those paths lack the default 'require all denied' protection, file reads succeed, and with CGI enabled on aliased paths this escalates to remote code execution. Only 2.4.49 is affected; the 2.4.50 fix was incomplete (see CVE-2021-42013).
Description
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, confirmed in-the-wild exploitation, CISA KEV listing with ransomware association, and near-maximum EPSS make this an urgent patch-first issue.
What it is
A path normalization flaw introduced in Apache HTTP Server 2.4.49 lets attackers map URLs to files outside directories configured by Alias-like directives. If those paths lack the default 'require all denied' protection, file reads succeed, and with CGI enabled on aliased paths this escalates to remote code execution. Only 2.4.49 is affected; the 2.4.50 fix was incomplete (see CVE-2021-42013).
Impact
An unauthenticated attacker can read files outside the web root and, where CGI is enabled on aliased paths, execute arbitrary code on the server. This yields full compromise of confidentiality, integrity and availability.
Attack surface
Reached over the network via crafted HTTP requests to a vulnerable server; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation depends on server configuration: aliased paths not protected by 'require all denied', and CGI enabled for code execution.
Exploitation
Exploited in the wild: CISA KEV lists it with a 2021-11-17 remediation due date and flags known ransomware campaign use, and EPSS is near maximum (0.99992). Multiple references are tagged Exploit, including public remote code execution proof-of-concepts.
What to do
- Upgrade Apache HTTP Server to 2.4.51 or later, which addresses both CVE-2021-41773 and the incomplete 2.4.50 fix (CVE-2021-42013).
- If immediate upgrade is not possible, ensure all Alias-like directories are covered by 'require all denied' so traversal requests fail.
- Disable CGI execution on aliased paths unless strictly required.
- Apply vendor updates for downstream packages (Fedora, Oracle, NetApp) that bundle the affected server.
- Audit exposed Apache 2.4.49 instances and treat any as compromised pending log review.
Detection
- Search web access logs for encoded traversal sequences such as %2e%2e%2f, .%2e/, or /cgi-bin/ requests targeting paths outside the web root.
- Alert on requests returning 200 for paths containing dot-dot segments or unusual absolute paths.
- Monitor for unexpected outbound connections or child processes spawned by the httpd user, indicating CGI-based code execution.
- Inventory servers still running Apache 2.4.49 and flag them for immediate remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-41773 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Apache HTTP Server Path Traversal Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-41773 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-41773), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
