CVE-2025-58098
High · 8.3CVSS
8.3
EPSS
1.4%
Published
Dec 5, 2025
CISA due date
—
The record
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | httpd | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-core | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-devel | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-filesystem | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:8 | httpd | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-devel | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-filesystem | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-manual | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-tools | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_http2 | 0 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 |
| AlmaLinux:8 | mod_ldap | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_md | 0 | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux:8 | mod_proxy_html | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_session | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_ssl | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:9 | httpd | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-core | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-devel | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-filesystem | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-manual | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-tools | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ldap | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_lua | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_proxy_html | 0 | 1:2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_session | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ssl | 0 | 1:2.4.62-7.el9_7.3 |
| Bitnami | apache | 0 | 2.4.66 |
| Mageia:9 | apache | 0 | 2.4.66-1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2 | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2-prefork | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | apache2-event | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-devel | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-utils | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-worker | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-event | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-manual | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.63-160000.3.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.66-1.1 |
Related vulnerabilities
- CVE-2025-65082 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects httpd
- CVE-2025-66200 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Also affects httpd
- CVE-2025-55753 An integer overflow in the case of failed ACME certificate renewal leads, after a number… Also affects httpd
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects httpd
- CVE-2025-59775 Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with… Also affects apache
- CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. Also affects apache
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2