High 7.5Known exploited (CISA KEV)Published Oct 5, 2021

CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

Updated under an hour ago (Oct 26, 2026, 9:20 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache HTTP Server and 4 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by Nov 17, 2021, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache HTTP Server

Exploited in the last 30 days

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVSS: 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-22
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due Nov 17, 2021; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.99% (percentile 100)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache HTTP Server apache_software_foundation:apache_http_server (from the name)	Apache HTTP Server 2.4 2.4.49	CNA record
apache http_server apache:http_server	2.4.49	NVD
fedoraproject fedora fedoraproject:fedora	34; 35	NVD
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack	17.1; 17.2; 17.3	NVD
netapp cloud_backup netapp:cloud_backup	all versions	NVD

References

References

https://httpd.apache.org/security/vulnerabilities_24.html	x-refsource-misc, release-notes, vendor-advisory
https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E	mailing-list, x-refsource-mlist
http://www.openwall.com/lists/oss-security/2021/10/05/2	mailing-list, x-refsource-mlist, third-party-advisory
http://www.openwall.com/lists/oss-security/2021/10/07/1	mailing-list, x-refsource-mlist, third-party-advisory
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
http://www.openwall.com/lists/oss-security/2021/10/07/6	mailing-list, x-refsource-mlist, third-party-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ	vendor-advisory, x-refsource-cisco
http://www.openwall.com/lists/oss-security/2021/10/08/1	mailing-list, x-refsource-mlist, exploit, third-party-advisory
1–10 of 27

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.