CVE-2021-41773

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-41773 9.8

Apache · HTTP Server · Added 2021-11-03 · Published 2021-10-05

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityApache HTTP Server Path Traversal Vulnerability

VendorApache

ProductHTTP Server

Date added2021-11-03

Due date2021-11-17

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default "require all denied" or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.

NVD: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-17 10:51 UTC

Wall time0.5s

Searches8

Component defaultyes

Sources https://blog.qualys.com/vulnerabilities-threat-research/2021/10/27/apache-http-server-path-traversal-remote-code-execution-cve-2021-41773-cve-2021-42013
https://httpd.apache.org/security/vulnerabilities_24.html
https://nvd.nist.gov/vuln/detail/CVE-2021-41773
https://www.rapid7.com/blog/post/2021/10/06/apache-http-server-cve-2021-41773-exploited-in-the-wild/
https://www.sentinelone.com/vulnerability-database/cve-2021-41773/
https://horizon3.ai/attack-research/attack-blogs/apache-cve-2021-41773-cve-2021-42013/
https://www.cisa.gov/news-events/alerts/2021/10/07/apache-releases-http-server-version-2451-address-vulnerabilities-under-exploitation
https://www.exploit-db.com/exploits/50383
https://sigma.nasbench.dev/rules/3007fec6-e761-4319-91af-e32e20ac43f5
https://socprime.com/blog/detect-cve-2021-41773-path-traversal-zero-day-in-apache-http-server/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-279a
https://detection.fyi/sigmahq/sigma/emerging-threats/2021/exploits/cve-2021-41773/web_cve_2021_41773_apache_path_traversal/
https://www.akamai.com/blog/news/how-akamai-helps-you-protect-against-0-days

QC notes

warn component_extraction: Component 'Apache HTTP Server URL path normalization component (cgi-bin directory handling)' matches or contains product name 'HTTP Server' — no specific component identified

Hunting hypothesis agent

Hunt access logs for /cgi-bin/.%2e/.%2e/.%2e/.%2e/ traversals toward /etc/passwd or /bin/sh (POSTs carry `echo Content-Type: text/plain; echo;` shell bodies); the traversal path is visible in stock Apache access logs.

Research details

ComponentApache HTTP Server URL path normalization component (cgi-bin directory handling)

PreconditionsNetwork reachability to the affected Apache HTTP Server on ports 80/443; No authentication required; Target must run Apache HTTP Server 2.4.49; CGI scripts must be enabled via mod_cgi for RCE; Default "require all denied" configuration must be absent for file read agent

Deliverynetwork_exploit

Public PoCyes

PoC URLs https://www.exploit-db.com/exploits/50383
https://www.rapid7.com/db/modules/exploit/multi/http/apache_normalize_path_rce/
https://github.com/Ls4ss/CVE-2021-41773_CVE-2021-42013
https://github.com/blackn0te/Apache-HTTP-Server-2.4.49-2.4.50-Path-Traversal-Remote-Code-Execution
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml Third-party repos; verify before use.

Advisoryhttps://httpd.apache.org/security/vulnerabilities_24.html

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0); Path traversal via /cgi-bin/../../ style patterns bypasses the document root; URL-encoded variants (.%2e/, %2e%2e/, %2e./) used to evade detection; Active scanning by threat actors within 24 hours of disclosure; Exploited by China-linked state-sponsored actors per CISA AA22-279A

SummaryCVE-2021-41773 is an unauthenticated path traversal vulnerability in Apache HTTP Server 2.4.49 introduced by a flawed path normalization change. Attackers send requests with /cgi-bin/.%2e/.%2e/ traversal patterns (and URL-encoded variants) to read arbitrary files outside the document root, achieving remote code execution when mod_cgi is enabled. The flaw was mass-scanned within days of its October 2021 disclosure and CISA added it to KEV on November 3, 2021. The original 2.4.50 patch proved incomplete, so remediation requires 2.4.51 (see CVE-2021-42013).

Tia coverage

First reported2026-09-11

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.