CVE-2021-41773: Apache HTTP Server path traversal, actively exploited
The short version: Apache HTTP Server 2.4.49 shipped a broken path-normalization change (CVE-2021-41773) that lets an attacker traverse outside the configured web directories to read sensitive files — and, where CGI is enabled on those paths, execute code. It's in CISA's KEV catalog, tied to known ransomware use, and only affects that one release. Upgrade off 2.4.49. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — actively exploited, trivial to weaponize, ransomware-associated |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2021-11-17 |
| Known exploited? | Yes — mass exploitation; CISA notes known ransomware campaign use |
| Vulnerability type | CWE-22 path traversal → arbitrary file read; remote code execution where CGI is enabled |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache HTTP Server 2.4.49 only (the 2.4.50 fix was incomplete — see CVE-2021-42013) |
| Fixed in | Apache HTTP Server 2.4.51 |
What you need to know
CVE-2021-41773 is a path-traversal flaw introduced by a change to URL path normalization in Apache HTTP Server 2.4.49. An attacker can craft a request that maps a URL to files outside the directories the server is configured to serve. If those files aren't protected by the default "require all denied," the request succeeds and returns their contents — and if CGI scripts are enabled for the aliased paths, the same weakness allows remote code execution.
Why it's top-of-queue despite a narrow footprint:
- It's trivial to exploit and automate. The payload is a simple crafted URL, and it was sprayed across the internet almost immediately after disclosure.
- It escalates from read to run. File disclosure alone is bad; with CGI enabled it becomes code execution.
- It's tied to ransomware. CISA flags known ransomware campaign use, so exposure carries real, demonstrated downside.
How serious we see it
High — actively exploited and easy to weaponize.
The one genuinely reassuring fact is the narrow blast radius: only 2.4.49 is affected. Earlier releases aren't, and the fix in 2.4.50 turned out to be incomplete (tracked as CVE-2021-42013), so the version to land on is 2.4.51. Within that narrow window, though, this is unauthenticated, network-reachable, trivially automated, and ransomware-associated — which is exactly why we rate it Critical and why it's in KEV.
Recommendations
Straight from the Apache HTTP Server security guidance and CISA:
- Upgrade off 2.4.49 now. Move to 2.4.51 or later — do not stop at 2.4.50 (incomplete fix).
- Hunt for prior use. Review access logs for traversal patterns (encoded
../sequences) against your web servers. - If you find indicators, respond. Where CGI was enabled, treat the host as potentially executed-against — rotate credentials and investigate.
- Harden. Ensure
require all deniedis in place for filesystem paths outside your web root; disable CGI where it isn't needed. - Confirm your exposure first. Verify whether any internet-facing server runs Apache HTTP Server 2.4.49.
How BreachRisk sees it
BreachRisk discovers your internet-facing web servers from little more than your domain, fingerprints the Apache HTTP Server version, and flags the ones running the affected 2.4.49 build — surfaced at the top of your results because this CVE is in KEV and tied to ransomware use.
That continuous, outside-in view is what keeps a single-release flaw from hiding: the exposed 2.4.49 server is mapped and ranked, so you can go straight to upgrading rather than discovering it after an attacker's automated scan does.