Apache Traversal

Last verified 2h ago

Apache HTTP Server 2.4.49 path traversal & RCE

Exploited in the wild?

KEV since Nov 3, 2021

YES · Active in KEV

Public exploit?

GitHub, Exploit-DB, Metasploit

YES · 141 PoCs

Patch available?

Upstream & major distros

YES · Upstream & distros

Severity

CVSS v3.1

9.8 CRITICAL

Risk signals

Known exploited

CISA KEV2021-11-03

Added Nov 3, 2021

EPSS probability

100th percentile

PoC repos

141

CVSS

9.8

Encoded dot segments escape DocumentRoot; with mod_cgi enabled, leads to RCE.

Per-distro commands are being verified

Our team is confirming fixed package versions for Apache httpd. Use your distribution's security tracker in the meantime.

Still the most-scanned bug on the internet. Embedded Log4j in vendor appliances keeps it alive.

Specific nginx fastcgi_split_path_info configs allow RCE in PHP-FPM.