CVE-2021-41773— Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Quick assessment
Affected
Apache Software Foundation Apache HTTP Server
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.49版本存在路径遍历漏洞，攻击者可利用该漏洞使用路径遍历攻击将URL映射到预期文档根以外的文件。
Public Exploits 5
Metasploit · 2
apache_normalize_path_rce.rb#CVE-2021-41773 [exploit]
apache_normalize_path.rb#CVE-2021-41773 [auxiliary]
Nuclei · 1
CVE-2021-41773.yaml [template]
In-the-Wild Activity Observed
github_trending · low
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-41773
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache HTTP Server 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.49版本存在路径遍历漏洞，攻击者可利用该漏洞使用路径遍历攻击将URL映射到预期文档根以外的文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 2.4.49 | - |
|
II. Public POCs for CVE-2021-41773
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49. | https://github.com/Vulnmachines/cve-2021-41773 | POC Details |
| 2 | CVE-2021-41773 | https://github.com/numanturle/CVE-2021-41773 | POC Details |
| 3 | Path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) | https://github.com/knqyf263/CVE-2021-41773 | POC Details |
| 4 | None | https://github.com/ZephrFish/CVE-2021-41773-PoC | POC Details |
| 5 | None | https://github.com/iilegacyyii/PoC-CVE-2021-41773 | POC Details |
| 6 | None | https://github.com/masahiro331/CVE-2021-41773 | POC Details |
| 7 | Exploitation of CVE-2021-41773 a Directory Traversal in Apache 2.4.49. | https://github.com/j4k0m/CVE-2021-41773 | POC Details |
| 8 | Poc.py | https://github.com/TishcaTpx/POC-CVE-2021-41773 | POC Details |
| 9 | None | https://github.com/lorddemon/CVE-2021-41773-PoC | POC Details |
| 10 | Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE | https://github.com/Ls4ss/CVE-2021-41773_CVE-2021-42013 | POC Details |
| 11 | CVE-2021-41773 POC with Docker | https://github.com/itsecurityco/CVE-2021-41773 | POC Details |
| 12 | PoC for CVE-2021-41773 with docker to demonstrate | https://github.com/habibiefaried/CVE-2021-41773-PoC | POC Details |
| 13 | CVE-2021-41773 | https://github.com/creadpag/CVE-2021-41773-POC | POC Details |
| 14 | CVE-2021-41773.nse | https://github.com/TAI-REx/cve-2021-41773-nse | POC Details |
| 15 | CVE-2021-41773 playground | https://github.com/blasty/CVE-2021-41773 | POC Details |
| 16 | Path Traversal vulnerability in Apache 2.4.49 | https://github.com/PentesterGuruji/CVE-2021-41773 | POC Details |
| 17 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773) | https://github.com/jbovet/CVE-2021-41773 | POC Details |
| 18 | None | https://github.com/mohwahyudi/cve-2021-41773 | POC Details |
| 19 | CVE-2021-41773 的复现 | https://github.com/1nhann/CVE-2021-41773 | POC Details |
| 20 | None | https://github.com/ranggaggngntt/CVE-2021-41773 | POC Details |
| 21 | Vulnerable docker images for CVE-2021-41773 | https://github.com/BlueTeamSteve/CVE-2021-41773 | POC Details |
| 22 | Metasploit-Framework modules (scanner and exploit) for the CVE-2021-41773 and CVE-2021-42013 (Path Traversal in Apache 2.4.49/2.4.50) | https://github.com/Zeop-CyberSec/apache_normalize_path | POC Details |
| 23 | None | https://github.com/r00tVen0m/CVE-2021-41773 | POC Details |
| 24 | exploit to CVE-2021-41773 | https://github.com/n3k00n3/CVE-2021-41773 | POC Details |
| 25 | None | https://github.com/fnatalucci/CVE-2021-41773-RCE | POC Details |
| 26 | Apache 2.4.49 | https://github.com/AssassinUKG/CVE-2021-41773 | POC Details |
| 27 | Simple script realizado en bash, para revisión de múltiples hosts para CVE-2021-41773 (Apache) | https://github.com/jheeree/Simple-CVE-2021-41773-checker | POC Details |
| 28 | Apache HTTPd (2.4.49) – Local File Disclosure (LFI) | https://github.com/orangmuda/CVE-2021-41773 | POC Details |
| 29 | A framework for bug hunting or pentesting targeting websites that have CVE-2021-41773 Vulnerability in public | https://github.com/HightechSec/scarce-apache2 | POC Details |
| 30 | CVE-2021-41773, poc, exploit | https://github.com/vinhjaxt/CVE-2021-41773-exploit | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-41773
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-41773 (5)
-
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
-
https://security.netapp.com/advisory/ntap-20211029-0009/ x_refsource_CONFIRM
-
🔗 Apache HTTPD: Multiple Vulnerabilities (GLSA 202208-20) — Gentoo security Read full article vendor-advisory x_refsource_GENTOO
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ vendor-advisory x_refsource_CISCO
Exploits & Public PoCs for CVE-2021-41773 (4)
Mailing List Discussions for CVE-2021-41773 (17)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ vendor-advisory x_refsource_FEDORA
-
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E mailing-list x_refsource_MLIST
-
https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E mailing-list x_refsource_MLIST
-
-
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E mailing-list x_refsource_MLIST
-
-
-
-
-
-
-
-
-
-
IV. Related Vulnerabilities
Same product: Apache HTTP Server
-
CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service -
CVE-2026-48913
Apache HTTP Server: mod_http2 memory corruption when file ha -
CVE-2026-42536
Apache HTTP Server: mod_xml2enc heap overflow -
CVE-2026-44185
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP ` -
CVE-2026-34355
Apache HTTP Server: mod_proxy_html buffer overflow
Same vendor: Apache Software Foundation
-
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-s -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp
Same weakness: CWE-22
-
CVE-2026-81491
boxpositron with-context-mcp index.ts project_folder path tr -
CVE-2026-81486
bsmi021 mcp-file-context-server Path Resolution index.ts rea -
CVE-2026-81485
danielpopamd linkedin-ads-mcp Media Upload campaign-manageme -
CVE-2026-61792
Weblate path traversal allows a project administrator to rea -
CVE-2026-63179
Winter: Local File Inclusion through @import directives in L
V. Comments for CVE-2021-41773
No comments yet