CVE-2021-42013: Apache HTTP Server path traversal and RCE via incomplete fix

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation in CISA KEV with ransomware use, near-maximum EPSS, and public exploit code make this an urgent patch-first issue.

What it is

The fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient, leaving a path traversal flaw that lets attackers map URLs to files outside directories configured by Alias-like directives. When those files are not protected by the default "require all denied" configuration, requests succeed, and if CGI scripts are enabled on the aliased paths, this escalates to remote code execution. Only Apache 2.4.49 and 2.4.50 are affected.

Impact

An unauthenticated attacker can read files outside the intended web root and, where CGI is enabled on aliased paths, execute arbitrary code on the server. This yields full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network via crafted HTTP requests to the web server; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation depends on server configuration: aliased paths lacking "require all denied" and, for RCE, CGI enabled on those paths.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is near maximum (0.99964, 99.976th percentile). Multiple public exploit references are tagged Exploit, confirming weaponized code is available.

What to do

• Upgrade Apache HTTP Server to 2.4.51 or later, which contains the complete fix.
• If immediate upgrade is not possible, ensure all Alias-like directories are protected with "require all denied" and disable CGI execution on aliased paths.
• Apply vendor patches for downstream products (Fedora, Oracle, NetApp) that bundle the affected httpd versions.
• Audit httpd configuration for aliased paths and CGI handlers that could expose files outside the web root.
• Restrict network exposure of affected Apache instances until patched.

Detection

• Inspect web server access logs for path traversal patterns such as encoded dot-dot sequences (e.g. %2e%2e, .%2e/, %%32%65) in request URIs.
• Alert on requests to aliased paths that resolve outside the document root or that target /cgi-bin/ with traversal sequences.
• Monitor for unexpected outbound connections or child processes spawned by the httpd user, which may indicate RCE.
• Correlate httpd logs with file access to sensitive paths such as /etc/passwd or configuration files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.