CVE-2021-41773

Confirmed PUBLISHED

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

Apache Software Foundation · Apache HTTP Server

Exploited in the wild Active exploitation observed Used in malware PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

860

Unique Attacker IPs

272

CISA KEV

In CISA KEV

CVSS / EPSS

7.5 High EPSS 100.0%

At a Glance

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

metasploit ransomware cisa apache malware nuclei_scanner

CVE Published: Oct 05, 2021
Exploitation Reported: Nov 03, 2021
CVSS: 7.5 High
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache HTTP Server	Apache HTTP Server 2.4 2.4.49	Affected

CVE References

20211007 Apache HTTP Server Vulnerabilties: October 2021 tools.cisco.com · Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory...
FEDORA-2021-2a10bc68a4 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2021-aaf90ef84a lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
GLSA-202208-20 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/202208-20
[httpd-users] 20211005 [users@httpd] CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17...

Show 24 more references

[announce] 20211005 CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1e...
[oss-security] 20211005 CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/05/2
[oss-security] 20211007 RE: CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/07/1
[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) lists.apache.org · Mailing List https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0...
[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fc...
[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/07/6
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/1
[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings lists.apache.org · Mailing List https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab...
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/2
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/3
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/4
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/6
[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/08/5
[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/09/1
[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/11/4
[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/15/3
[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/10/16/1
httpd.apache.org/security/vulnerabilities_24.html httpd.apache.org · CVE Record https://httpd.apache.org/security/vulnerabilities_24.html
packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49...
packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49...
oracle.com/security-alerts/cpujan2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujan2022.html
security.netapp.com/advisory/ntap-20211029-0009 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20211029-0009/
packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Trav...
packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remot... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
KEVIntel	2026-07-16 15:07 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 7
Distinct User-Agents: 24

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-07-09 15:16:24 UTC · KEVIntel sensor

Used in malware

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-10-05 16:18:09 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Vanshuk-Bhagat/Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

github · Created 2025-03-11 07:56:58 UTC · 0 stars

In this project, I documented a detailed penetration testing process targeting Apache HTTP Server vulnerabilities, specifically CVE-2021-41773 and CVE-2021-42013, which involve Path Traversal and Remote Code Execution (RCE).

0xc4t/CVE-2021-41773

github · Created 2024-08-26 09:07:33 UTC · 0 stars

POC & Lab For CVE-2021-41773

belajarqywok/CVE-2021-41773-MSF

github · Created 2023-08-11 12:12:09 UTC · 6 stars

Simple Metasploit-Framework module for conducting website penetration tests (CVE-2021-41773).

OfriOuzan/CVE-2021-41773_CVE-2021-42013_Exploits

github · Created 2023-08-02 09:50:10 UTC · 4 stars

Exploit CVE-2021-41773 and CVE-2021-42013

aqiao-jashell/py-CVE-2021-41773

github · Created 2022-11-01 09:17:03 UTC · 7 stars

python编写的apache路径穿越poc&exp

aqiao-jashell/CVE-2021-41773

github · Created 2022-11-01 05:58:59 UTC · 9 stars

apache路径穿越漏洞poc&exp

Habib0x0/CVE-2021-41773

github · Created 2022-06-07 11:22:08 UTC · 2 stars

CVE-2021-41773 | Apache HTTP Server 2.4.49 is vulnerable to Path Traversal and Remote Code execution attacks

Chocapikk/CVE-2021-41773

github · Created 2022-04-12 13:25:58 UTC · 2 stars

zer0qs/CVE-2021-41773

github · Created 2022-03-30 15:04:27 UTC · 0 stars

thehackersbrain/CVE-2021-41773

github · Created 2022-03-12 21:24:55 UTC · 107 stars

Apache2 2.4.49 - LFI & RCE Exploit - CVE-2021-41773

mauricelambert/CVE-2021-41773

github · Created 2022-03-08 21:55:53 UTC · 1 stars

These Metasploit, Nmap, Python and Ruby scripts detects and exploits CVE-2021-41773 with RCE and local file disclosure.

Soliux/CVE-2021-41773

github · Created 2021-11-11 15:10:08 UTC · 2 stars

On the 11/11/21 the apache 2.4.49-2.4.50 remote command execution POC has been published online and this is a loader so that you can mass exploit servers using this.

pirenga/CVE-2021-41773

github · Created 2021-11-11 13:10:05 UTC · 0 stars

Ce programme permet de détecter une faille RCE sur les serveurs Apache 2.4.49 et Apache 2.4.50

Hydragyrum/CVE-2021-41773-Playground

github · Created 2021-11-04 22:52:44 UTC · 6 stars

Some docker images to play with CVE-2021-41773 and CVE-2021-42013

mr-exo/CVE-2021-41773

github · Created 2021-10-26 17:56:25 UTC · 10 stars

Remote Code Execution exploit for Apache servers. Affected versions: Apache 2.4.49, Apache 2.4.50

zerodaywolf/CVE-2021-41773_42013

github · Created 2021-10-18 12:01:58 UTC · 2 stars

Lab setup for CVE-2021-41773 (Apache httpd 2.4.49) and CVE-2021-42013 (Apache httpd 2.4.50).

lopqto/CVE-2021-41773_Honeypot

github · Created 2021-10-16 15:30:34 UTC · 2 stars

Simple honeypot for CVE-2021-41773 vulnerability

LudovicPatho/CVE-2021-41773

github · Created 2021-10-15 21:38:48 UTC · 3 stars

The first vulnerability with the CVE identifier CVE-2021-41773 is a path traversal flaw that exists in Apache HTTP Server 2.4.49.

inbug-team/CVE-2021-41773_CVE-2021-42013

github · Created 2021-10-09 03:32:18 UTC · 147 stars

CVE-2021-41773 CVE-2021-42013漏洞批量检测工具

superzerosec/CVE-2021-41773

github · Created 2021-10-08 15:40:41 UTC · 3 stars

POC

zeronine9/CVE-2021-41773

github · Created 2021-10-08 07:24:49 UTC · 11 stars

Fast python tool to test apache path traversal CVE-2021-41773 in a List of url

corelight/CVE-2021-41773

github · Created 2021-10-08 06:54:27 UTC · 1 stars

A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013)

0xRar/CVE-2021-41773

github · Created 2021-10-08 04:26:31 UTC · 7 stars

Exploit for Apache 2.4.49

shellreaper/CVE-2021-41773

github · Created 2021-10-08 01:13:33 UTC · 1 stars

This is a simple POC for Apache/2.4.49 Path Traversal Vulnerability

noflowpls/CVE-2021-41773

github · Created 2021-10-07 12:30:13 UTC · 6 stars

CVE-2021-41773

orangmuda/CVE-2021-41773

github · Created 2021-10-07 00:14:40 UTC · 3 stars

Apache HTTPd (2.4.49) – Local File Disclosure (LFI)

jheeree/Simple-CVE-2021-41773-checker

github · Created 2021-10-06 23:32:30 UTC · 2 stars

Simple script realizado en bash, para revisión de múltiples hosts para CVE-2021-41773 (Apache)

AssassinUKG/CVE-2021-41773

github · Created 2021-10-06 21:37:18 UTC · 2 stars

Apache 2.4.49

n3k00n3/CVE-2021-41773

github · Created 2021-10-06 19:39:25 UTC · 1 stars

exploit to CVE-2021-41773

BlueTeamSteve/CVE-2021-41773

github · Created 2021-10-06 14:47:23 UTC · 20 stars

Vulnerable docker images for CVE-2021-41773

ranggaggngntt/CVE-2021-41773

github · Created 2021-10-06 14:36:05 UTC · 0 stars

1nhann/CVE-2021-41773

github · Created 2021-10-06 14:17:31 UTC · 10 stars

CVE-2021-41773 的复现

jbovet/CVE-2021-41773

github · Created 2021-10-06 13:39:57 UTC · 4 stars

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773)

blasty/CVE-2021-41773

github · Created 2021-10-06 07:17:05 UTC · 208 stars

CVE-2021-41773 playground

creadpag/CVE-2021-41773-POC

github · Created 2021-10-06 05:34:48 UTC · 8 stars

CVE-2021-41773

habibiefaried/CVE-2021-41773-PoC

github · Created 2021-10-06 03:01:41 UTC · 4 stars

PoC for CVE-2021-41773 with docker to demonstrate

itsecurityco/CVE-2021-41773

github · Created 2021-10-06 02:30:40 UTC · 11 stars

CVE-2021-41773 POC with Docker

Ls4ss/CVE-2021-41773_CVE-2021-42013

github · Created 2021-10-06 02:28:41 UTC · 21 stars

Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE

lorddemon/CVE-2021-41773-PoC

github · Created 2021-10-05 23:53:48 UTC · 37 stars

TishcaTpx/POC-CVE-2021-41773

github · Created 2021-10-05 20:41:34 UTC · 6 stars

Poc.py

j4k0m/CVE-2021-41773

github · Created 2021-10-05 20:30:01 UTC · 12 stars

Exploitation of CVE-2021-41773 a Directory Traversal in Apache 2.4.49.

iilegacyyii/PoC-CVE-2021-41773

github · Created 2021-10-05 17:30:43 UTC · 47 stars

ZephrFish/CVE-2021-41773-PoC

github · Created 2021-10-05 17:29:49 UTC · 17 stars

knqyf263/CVE-2021-41773

github · Created 2021-10-05 16:45:41 UTC · 10 stars

Path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773)

numanturle/CVE-2021-41773

github · Created 2021-10-05 16:18:09 UTC · 9 stars

CVE-2021-41773

Apache 2.4.49 - Path Traversal and Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

9 Jul 2026 15:16 UTC 8 days ago

9 Jul 2026 15:16 UTC · 8 days ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
9 Jul 2026 15:16 UTC 8 days ago

9 Jul 2026 15:16 UTC · 8 days ago

Indicators of compromise added (272)

Indicators of compromise recorded
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
5 Oct 2021 16:18 UTC almost 5 years ago

5 Oct 2021 16:18 UTC · almost 5 years ago

Public PoC available

Public proof-of-concept code published
5 Oct 2021 08:40 UTC almost 5 years ago

5 Oct 2021 08:40 UTC · almost 5 years ago

CVE published

Vulnerability disclosed publicly
29 Sep 2021 00:00 UTC almost 5 years ago

29 Sep 2021 00:00 UTC · almost 5 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-41773

{
  "cve_id": "CVE-2021-41773",
  "title": "Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache HTTP Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.99992,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-41773

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 10 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API