CVE-2021-42013Used in ransomware
Apache HTTP Server
Apache HTTP Server Path Traversal Vulnerability
What it is
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Apache entries on the list
- Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 · Oct 8, 2026
- Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 · Aug 4, 2026
- ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 · Apr 16, 2026
- HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475 · May 1, 2025
- Tomcat Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 · Apr 1, 2025
- OFBiz Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 · Feb 4, 2025