CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-07 · updated 2026-06-17
Weakness: CWE-22

Description

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Affected products

Apache HTTP Server: 2.4.49, 2.4.50
Fedoraproject Fedora: 34, 35
NetApp Cloud Backup: all versions
Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
Oracle Corporation Oracle Secure Backup: before 18.1.0.1.0 — fixed in 18.1.0.1.0

How to fix

Upgrade to a fixed version: Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0; Oracle Corporation Oracle Secure Backup 18.1.0.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-42013 or the next vulnerability affects your stack