CVE-2021-41773

Summary

Path traversal (and its include-side variant, Local File Inclusion) occurs when an application builds a filesystem path from user input without canonicalizing and validating it, so sequences like ../ or their URL-encoded forms (%2e%2e%2f) walk out of the intended base directory to read or include arbitrary files such as /etc/passwd or application source. The root cause at the code level is concatenating untrusted input into a path and resolving it before checking that the final canonical path stays within an allowed root. CVE-2021-41773, disclosed 5 October 2021 and rated CVSS 9.8, was a path traversal in Apache HTTP Server 2.4.49 caused by a flawed change to URL path normalization that failed to decode and reject encoded dot-segments; requests mapping outside Alias-configured directories disclosed files, and where mod_cgi was enabled it escalated to remote code execution. It was mass-exploited in the wild within days and the incomplete 2.4.50 fix led to CVE-2021-42013. This class maps to OWASP A01:2021 Broken Access Control.

Severity

critical

EPSS

100.0% (p100)

CWE

CWE-22

Also known as

APPSEC-PATH-TRAVERSAL, Directory Traversal, Local File Inclusion, Path Traversal

Published

2021-10-05

How to fix it

• For CVE-2021-41773 and the related CVE-2021-42013, upgrade Apache HTTP Server to 2.4.51 or later; both 2.4.49 and the incomplete 2.4.50 fix are vulnerable.
• As an interim mitigation on Apache, default-deny filesystem access with `Require all denied` and disable `mod_cgi` where it is not needed, so a file read cannot escalate to remote code execution.
• In application code, canonicalize the resolved path (realpath) and confirm it stays within the allowed root before opening it, rejecting decoded traversal sequences (`%2e%2e`, `..`, null bytes).
• Review access and error logs for traversal payloads (`%2e%2e`, `.%2e`, `/cgi-bin/`) and treat any successful hit as a potential compromise.

How to avoid it

• Canonicalize the resolved path (realpath) and verify it is prefixed by the allowed base directory before opening.
• Reject input containing path separators, dot-segments, and null bytes after full URL decoding.
• Map user input to an allow-list of identifiers instead of using it directly as a filename.
• Serve files via a fixed root with chroot or container isolation and least-privilege file permissions.
• Keep web servers patched; disable mod_cgi and dynamic include features where not needed.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-41773
• https://www.rapid7.com/blog/post/2021/10/06/apache-http-server-cve-2021-41773-exploited-in-the-wild/
• https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/

Related advisories

• CVE-2026-75604 — critical · npm/next
• CVE-2026-65600 — critical · Go/github.com/traefik/traefik/v2
• CVE-2026-67429 — critical · PyPI/flyto-core
• CVE-2026-59864 — critical · NuGet/Microsoft.OpenApi.Kiota
• GHSA-p63j-vcc4-9vmv — critical · npm/@vitest/browser
• GHSA-hgjx-r89m-m7v4 — critical · Packagist/facturascripts/facturascripts
• CVE-2026-50006 — critical · Go/github.com/julien040/anyquery
• CVE-2026-27823 — critical · Packagist/egroupware/egroupware

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity