PT-2025-49184 · Apache+10 · Apache Http Server+10

Mattias Åsander · Published 2025-01-01 · Updated 2026-05-28 · CVE-2025-66200

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.7 through 2.4.65

Description A flaw exists in Apache HTTP Server where a bypass of mod userdir+suexec is possible via the AllowOverride FileInfo functionality. Individuals with the ability to utilize the RequestHeader directive within an htaccess file can potentially cause CGI scripts to execute under an unintended user ID.

Recommendations Upgrade to version 2.4.66 to resolve this issue.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

ALSA-2025:23732

ALSA-2025:23919

ALSA-2025:23932

AZL-71528

AZL-71590

BDU:2025-15638

BIT-APACHE-2025-66200

CVE-2025-66200

MGASA-2025-0322

OESA-2026-1527

OESA-2026-1528

OESA-2026-1529

OESA-2026-1592

OESA-2026-1593

OPENSUSE-SU-2025:15808-1

OPENSUSE-SU-2026:20030-1

OPENSUSE-SU-2026:20810-1

RHSA-2026:2994

RHSA-2026:5156

SUSE-SU-2025:4488-1

SUSE-SU-2025:4518-1

SUSE-SU-2026:0019-1

SUSE-SU-2026:0020-1

SUSE-SU-2026:20081-1

USN-7968-1

USN-8338-1

Affected Products

Alt Linux

Almalinux

Apache Http Server

Centos

Debian

Linuxmint

Apple Macos

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 122

• https://errata.almalinux.org/10/ALSA-2025-23932.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58098 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1528 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20030-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-23732.html · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24795 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66200 · Security Note
• https://ubuntu.com/security/CVE-2024-38476 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4488-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38473 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-55753 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-66200 · Vendor Advisory