Critical 9.8Known exploited (CISA KEV)Published Oct 7, 2021

CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Updated under an hour ago (Oct 27, 2026, 6:50 AM ET)

Does this affect you?

It affects Apache Software Foundation Apache HTTP Server and 6 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by Nov 17, 2021, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache HTTP Server

Exploited in the last 30 days

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-22
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due Nov 17, 2021; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.96% (percentile 100)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache HTTP Server apache_software_foundation:apache_http_server (from the name)	Apache HTTP Server 2.4.49; Apache HTTP Server 2.4.50	CNA record
apache http_server apache:http_server	2.4.49; 2.4.50	NVD
fedoraproject fedora fedoraproject:fedora	34; 35	NVD
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack	17.1; 17.2; 17.3	NVD
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools	before 9.2.6.0	NVD
oracle secure_backup oracle:secure_backup	before 18.1.0.1.0	NVD
netapp cloud_backup netapp:cloud_backup	all versions	NVD

References

References

https://httpd.apache.org/security/vulnerabilities_24.html	x-refsource-misc, release-notes, vendor-advisory
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
http://www.openwall.com/lists/oss-security/2021/10/07/6	mailing-list, x-refsource-mlist, third-party-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ	vendor-advisory, x-refsource-cisco
http://jvn.jp/en/jp/JVN51106450/index.html	third-party-advisory, x-refsource-jvn
http://www.openwall.com/lists/oss-security/2021/10/08/1	mailing-list, x-refsource-mlist, third-party-advisory
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E	mailing-list, x-refsource-mlist, patch
http://www.openwall.com/lists/oss-security/2021/10/08/2	mailing-list, x-refsource-mlist, third-party-advisory
http://www.openwall.com/lists/oss-security/2021/10/08/3	mailing-list, x-refsource-mlist, third-party-advisory
1–10 of 28

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.