Vulnerability threat dossier
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
VTP analyst assessment
Apache HTTP Server 2.4.49 contains a network-reachable path-normalization flaw that can expose files outside configured directories and may enable further impact when CGI is enabled. It has CVSS 9.8, is KEV-listed, and KEV associates it with known ransomware use.
1 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
Whether Apache 2.4.49, permissive file access, or CGI is present is unknown.
No first-party telemetry, supporting assertions, source text, or known exploit artifact is supplied.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Inventory for Apache HTTP Server 2.4.49 and verify remediation.
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2021-41773. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.