Every CVE Search/ Get API key

CVE-2021-42013

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

9.8 CriticalIn KEVPublic exploitFix available

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 85.6 points since Oct 8, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE List 9.8

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2021-29001 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
EUVD-2021-29001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-m24x-wx9p-jqmh 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An...

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
GHSA-m24x-wx9p-jqmh
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CISA KEV No score

Apache HTTP Server Path Traversal Vulnerability

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.

Record
CVE-2021-42013
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2021-42013 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
ALPINE-CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVBELL-CVE-2021-42013 9.8

CVE-2021-42013 does not affect BellSoft software

Record
BELL-CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-42013 9.8

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
DEBIAN-CVE-2021-42013
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-apache-2021-42013 No score

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Record
BIT-apache-2021-42013
Updated
2026-11-02
OSVMGASA-2021-0470 No score

Updated apache packages fix security vulnerability

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution (CVE-2021-42013).

Record
MGASA-2021-0470
Updated
2026-11-02
OSVopenSUSE-SU-2024:11560-1 No score

apache2-2.4.51-1.1 on GA media

These are all security issues fixed in the apache2-2.4.51-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11560-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.11
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.12
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.13
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.14
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.15
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.16
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.17
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.18
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.19
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.20
 before 2.4.51-r0
2.4.51-r0
Show 10 moreShow less
Affected packages
PackageAffectedFixed
apache2
Alpine:v3.21
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.22
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.23
 before 2.4.51-r0
2.4.51-r0
apache2
Alpine:v3.24
 before 2.4.51-r0
2.4.51-r0
apache
Bitnami
 2.4.49 up to 2.4.50, 2.4.50 up to 2.4.51
2.4.502.4.51
apache2
Debian:12
 before 2.4.51-1
2.4.51-1
apache2
Debian:13
 before 2.4.51-1
2.4.51-1
apache2
Debian:14
 before 2.4.51-1
2.4.51-1
apache
Mageia:8
 before 2.4.51-1.mga8
2.4.51-1.mga8
apache2
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.4.51-1.1
2.4.51-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache 2.4.49/2.4.50 Traversal RCE2021-05-10
PoC in GitHubandrea-mattioli/apache-exploit-CVE-2021-420132021-10-07
PoC in GitHubVulnmachines/cve-2021-420132021-10-08
Exploit-DBApache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)2021-10-13
PoC in GitHubtwseptian/cve-2021-42013-docker-lab2021-10-14
PoC in GitHubLayarKacaSiber/CVE-2021-420132021-10-20
PoC in GitHubTheLastVvV/CVE-2021-420132021-10-23
PoC in GitHubTheLastVvV/CVE-2021-42013_Reverse-Shell2021-10-24
Exploit-DBApache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2)2021-10-25
PoC in GitHubwalnutsecurity/cve-2021-420132021-10-27
Show 21 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubrobotsense1337/CVE-2021-420132021-11-03
Exploit-DBApache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)2021-11-11
PoC in GitHubxMohamed0/CVE-2021-42013-ApacheRCE2021-11-14
PoC in GitHubasaotomo/CVE-2021-42013-Apache-RCE-Poc-Exp2021-12-23
PoC in GitHubrnsss/CVE-2021-420132022-01-07
PoC in GitHubjas9reet/CVE-2021-42013-LAB2022-02-03
PoC in GitHubmauricelambert/CVE-2021-420132022-03-08
PoC in GitHubhadrian3689/apache_2.4.502022-04-18
PoC in GitHubviliuspovilaika/cve-2021-420132022-05-31
PoC in GitHubmightysai1997/cve-2021-420132022-09-15
PoC in GitHubmightysai1997/cve-2021-42013.get2022-09-15
PoC in GitHubmightysai1997/cve-2021-42013L2022-09-15
PoC in GitHub12345qwert123456/CVE-2021-420132022-11-18
PoC in GitHubcybfar/cve-2021-42013-httpd2023-06-08
PoC in GitHubvudala/CVE-2021-420132023-06-20
PoC in GitHubHamesawian/CVE-2021-420132023-06-29
PoC in GitHubBassoNicolas/CVE-2021-420132024-04-07
PoC in GitHubdream434/cve-2021-42013-apache2024-07-16
PoC in GitHubbananoname/cve-2021-420132024-07-31
MetasploitApache 2.4.49/2.4.50 Traversal RCE scanner2021-05-10
NucleiApache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

History

History
RecordedChangedSources
affected
exploits_morePoC in GitHub
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-42013 is a critical vulnerability (CVSS 9.8) in Apache Http Server, published October 7, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in apache2 2.4.51-r0.

References

Show 41 moreShow less
This page doesn't list everything

The full exploit list has 13 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open