CVE-2002-0661

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware...

7.5 HighPublic exploitFix available

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.

Exploit likelihood

69.7%Up 36.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2002-0661
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2002-0661
Updated: 2026-11-02

EUVDEUVD-2002-0655 No score

Record: EUVD-2002-0655
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cjcj-mxqx-222g No score

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware...

Record: GHSA-cjcj-mxqx-222g
Updated: 2026-11-02

OSV No score

Record: CVE-2002-0661
Updated: 2026-11-02

OSVDEBIAN-CVE-2002-0661 No score

Record: DEBIAN-CVE-2002-0661
Updated: 2026-11-02

Affected products

apache http server

Affected packages

Affected packages
Package	Affected	Fixed
`apache2` Debian:12	before 2.0.40	2.0.40
`apache2` Debian:13	before 2.0.40	2.0.40
`apache2` Debian:14	before 2.0.40	2.0.40

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache 2.0 - Encoded Backslash Directory Traversal	2002-08-09

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2002-0661 is a high vulnerability (CVSS 7.5) in Apache Http Server, published August 10, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.7%, the 99th percentile. Fixed in apache2 2.0.40.

References

Show 26 moreShow less