What’s Vulnerable › Vulnerabilities

CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-18
• Weakness: CWE-288

Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Affected products

• Apache HTTP Server: from 2.4.7 before 2.4.66 — fixed in 2.4.66

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.4.66. Check the vendor advisory for mitigations.

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/12/04/8

Get alerted when CVE-2025-66200 or the next vulnerability affects your stack