{"basis":"claimed","id":"CVE-2021-41773","name":"Apache HTTP Server Path Traversal Vulnerability","vendorProject":"Apache","product":"HTTP Server","publishedAt":"2021-10-05","cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"exploited":{"kevAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true},"epss":{"score":0.99992,"percentile":0.99986,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2024-03-12","daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":"Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","cwes":["CWE-22"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2024-03-12","firstIsNew":false,"daysToRule":null,"daysAtMost":889,"freePlan":false,"claims":[{"id":"9f1148e49dff19ced95b7c393ee47a0fc05a6d88d8c11b162871f1223a337f11","cve_id":"CVE-2021-41773","vendor":"f5","product":"Attack signatures","rule_id":"200007043","rule_name":"Directory Traversal attempt \"../\" (URI) (%%32%65%%32%65)","change":"updated","default_action":null,"published_on":"2024-03-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200007043 \"Directory Traversal attempt \"../\" (URI) (%%32%65%%32%65)\" (Path Traversal, risk High), systems: Apache. References: CVE-2021-42013, CVE-2021-41773.","first_seen_at":"2026-11-02T21:00:27.754Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-04T02:17:45.826Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"kevAction":"Apply updates per vendor instructions.","kevNotes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41773","references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","name":null,"tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E","name":"[httpd-users] 20211005 [users@httpd] CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E","name":"[announce] 20211005 CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/05/2","name":"[oss-security] 20211005 CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/1","name":"[oss-security] 20211007 RE: CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E","name":"[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E","name":"[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-202","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/6","name":"[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ","name":"20211007 Apache HTTP Server Vulnerabilties: October 2021","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/1","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E","name":"[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/2","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/3","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/4","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/6","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/5","name":"[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/09/1","name":"[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html","name":null,"tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html","name":null,"tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/11/4","name":"[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/","name":"FEDORA-2021-2a10bc68a4","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/","name":"FEDORA-2021-aaf90ef84a","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/15/3","name":"[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/16/1","name":"[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","name":null,"tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0009/","name":null,"tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html","name":null,"tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html","name":null,"tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202208-20","name":"GLSA-202208-20","tags":["vendor-advisory","x_refsource_GENTOO"]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","affected":["Apache HTTP Server 2.4 2.4.49"],"fixed":[]}],"briefing":{"status":{"id":"known_exploited","label":"Known exploited"},"why":"CISA lists CVE-2021-41773 as exploited in the wild since 2021-11-03, including known use in ransomware campaigns. It is reachable over the network without credentials or any user interaction (CVSS 7.5). A Metasploit module exists, so exploitation needs no custom work. In our benchmark, 4 of 6 WAF configurations stopped every variant of the public exploit.","who":"Teams running Apache Software Foundation Apache HTTP Server (Apache HTTP Server 2.4 2.4.49). Prioritise internet-facing instances.","what_to_do":[{"text":"Find the version you run. On the server:","command":{"where":"On the server","command":"httpd -v || apache2 -v"}},{"text":"Apply the vendor's fix; the advisory lists the affected and fixed versions.","href":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ","linkText":"20211007 Apache HTTP Server Vulnerabilties: October 2021"},{"text":"CISA's required action: Apply updates per vendor instructions. US federal agencies must act by 2021-11-17."},{"text":"Review exposed instances for signs of compromise: it was exploited before many systems were patched, and a later patch does not undo access already gained."},{"text":"Keep a WAF rule in place while you patch: F5 ships a rule you may need to switch on. A WAF rule reduces exposure; it does not replace the patch.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 3.1 7.5 (high). Weakness: CWE-22.","links":[{"label":"CVE-2021-41773","href":"https://www.cve.org/CVERecord?id=CVE-2021-41773"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-41773"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"20211007 Apache HTTP Server Vulnerabilties: October 2021","href":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"},{"label":"FEDORA-2021-2a10bc68a4","href":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"},{"label":"FEDORA-2021-aaf90ef84a","href":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"},{"label":"GLSA-202208-20","href":"https://security.gentoo.org/glsa/202208-20"}]},{"heading":"Exploit evidence","text":"Metasploit has a module. Exploit-DB lists 2 exploits. A nuclei template exists, which our lab and benchmark replay.","links":[{"label":"Metasploit: Apache 2.4.49/2.4.50 Traversal RCE scanner","href":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_normalize_path.rb"},{"label":"Metasploit: Apache 2.4.49/2.4.50 Traversal RCE","href":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb"},{"label":"Exploit-DB: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)","href":"https://www.exploit-db.com/exploits/50512"},{"label":"Exploit-DB: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)","href":"https://www.exploit-db.com/exploits/50383"}]},{"heading":"Seen exploited","text":"Claimed in 4 Telegram posts (unverified).","links":[]},{"heading":"CISA KEV","text":"Added 2021-11-03, federal due date 2021-11-17, known ransomware use (catalog 2026.11.03, checked 2026-11-04).","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-41773"}]},{"heading":"EPSS","text":"99.9% probability of exploitation activity in the next 30 days, higher than 99% of CVEs (2026-11-02).","links":[{"label":"FIRST EPSS","href":"https://api.first.org/data/v1/epss?cve=CVE-2021-41773"}]},{"heading":"WAF vendor statements","text":"F5 names it in a changelog. Quotes and dates below.","links":[{"label":"Vendor statements","href":"#evidence"}]},{"heading":"Measured","text":"4 of 6 WAF configurations stopped every variant of the public exploit in our daily benchmark.","links":[{"label":"WAF benchmark","href":"/bench"}]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2021-41773 (Apache HTTP Server Path Traversal Vulnerability). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2021-41773 and the vendor advisories (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/). Establish affected and fixed versions, including vendor backports. The record lists: Apache Software Foundation Apache HTTP Server: affected Apache HTTP Server 2.4 2.4.49. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of Apache HTTP Server: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags), e.g. `httpd -v || apache2 -v` (on the server). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: F5: rule exists, check whether it is enabled. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2021-41773. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. It is known exploited (CISA KEV): review logs on exposed instances for signs of exploitation before and after patching.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Apply the vendor's fix; the advisory lists the affected and fixed versions. CISA's required action: Apply updates per vendor instructions. US federal agencies must act by 2021-11-17.\nMore: https://cve.vigilbase.com/cve/CVE-2021-41773"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-04T00:34:40.000Z","verdict":"blocked","templateId":"CVE-2021-41773","templatePath":"http/cves/2021/CVE-2021-41773.yaml","requests":3,"blockedRequests":3,"rules":["930100","930110","932235"],"note":"","requestDetail":[{"method":"GET","path":"/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"GET","path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"POST","path":"/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh","status":403,"blocked":true,"rules":["930100","930110","932235"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-04T00:34:40.000Z","verdict":"blocked","templateId":"CVE-2021-41773","templatePath":"http/cves/2021/CVE-2021-41773.yaml","requests":3,"blockedRequests":3,"rules":["930100","930110","932235","932236"],"note":"","requestDetail":[{"method":"GET","path":"/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"GET","path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"POST","path":"/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh","status":403,"blocked":true,"rules":["930100","930110","932235","932236"]}]}],"sightings":{"honeypot":null,"catalog":null,"reports":[],"telegram":{"posts":4,"last":"2026-09-10"},"days":{"honeypot":[],"reports":[],"telegram":["2026-09-07","2026-09-10"]}},"social":{"total":1,"first_seen":"2026-11-04T00:33:35.000Z","daily":[{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0},{"day":"2026-11-04","posts":1}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/k2024new/status/2117777240855634313","author":"k2024new","author_name":"圭","avatar_url":"https://pbs.twimg.com/profile_images/1858139320642875392/uHBbU0Tp_bigger.jpg","text":"【φ(..)メモ】\nリリースから年数が経過したApacheは、パストラバーサルやRCEの脆弱性（CVE-2021-41773、CVE-2021-42013など）\n※Ubuntuのセキュリティアップデート（LTSの公式パッチ）適用\nhttps://t.co/CkSSoyQhSC\n※見落としがちなURL正規化によるパストラバーサル（GMO）\nhttps://t.co/iBwDpe2Iat","engagement":0,"posted_at":"2026-11-04T00:33:35.000Z"}],"exploit_repositories":[]}}