What is CVE-2021-42013?

CVE-2021-42013 is a critical-severity vulnerability in Apache HTTP Server, classified under Path Traversal. CVSS score: 9.8/10. Published 2021-10-07.

How severe is CVE-2021-42013?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2021-42013 known to be exploited?

Yes. CVE-2021-42013 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 268 public proof-of-concept repositories are indexed.

Path Traversal in Apache HTTP Server

CVE-2021-42013

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2021-10-07 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 1.000 (100.0th percentile), scored 2026-09-13.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Apache HTTP Server — versions 2.4.49, 2.4.50
Apache Software Foundation HTTP Server — versions Apache HTTP Server 2.4.49, Apache HTTP Server 2.4.50
NetApp Cloud Backup
Oracle Instantis Enterprisetrack — versions 17.1, 17.2, 17.3
Oracle Jd Edwards Enterpriseone Tools
Oracle Secure Backup
Fedoraproject Fedora — versions 34, 35

Weakness classification (CWE)

CWE-22 — Path Traversal

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2021-11-03. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2021-11-17.

Required action: Apply updates per vendor instructions.

Known ransomware campaign use: yes.

Public proof-of-concept exploits

References

httpd.apache.org/security/vulnerabilities_24.html (Release Notes, Vendor Advisory)
lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061… (mailing-list, Mailing List)
lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971… (mailing-list, Mailing List)
www.openwall.com/lists/oss-security/2021/10/07/6 (mailing-list, Mailing List, Third Party Advisory)
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-h… (vendor-advisory, Third Party Advisory)
jvn.jp/en/jp/JVN51106450/index.html (Third Party Advisory, third-party-advisory)
www.openwall.com/lists/oss-security/2021/10/08/1 (mailing-list, Mailing List, Third Party Advisory)
lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc6826… (mailing-list, Patch, Mailing List)
www.openwall.com/lists/oss-security/2021/10/08/2 (mailing-list, Mailing List, Third Party Advisory)
www.openwall.com/lists/oss-security/2021/10/08/3 (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2021-42013?: CVE-2021-42013 is a critical-severity vulnerability in Apache HTTP Server, classified under Path Traversal. CVSS score: 9.8/10. Published 2021-10-07.
How severe is CVE-2021-42013?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2021-42013 known to be exploited?: Yes. CVE-2021-42013 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 268 public proof-of-concept repositories are indexed.