What’s Vulnerable › Vulnerabilities

CVE-2021-43557: Path traversal in request_uri variable

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-22 · updated 2026-06-17
• Weakness: CWE-77

Description

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Affected products

• Apache Software Foundation Apache APISIX: before 2.10.2 — fixed in 2.10.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache APISIX 2.10.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/11/22/1
• http://www.openwall.com/lists/oss-security/2021/11/22/2
• http://www.openwall.com/lists/oss-security/2021/11/23/1
• https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
• http://www.openwall.com/lists/oss-security/2021/11/22/1
• http://www.openwall.com/lists/oss-security/2021/11/22/2
• http://www.openwall.com/lists/oss-security/2021/11/23/1
• https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h

Get alerted when CVE-2021-43557 or the next vulnerability affects your stack