Apache HTTP Server mod_userdir+suexec Bypass Vulnerability - CVE-2025-66200
Summary
ALPINE-CVE-2025-66200: mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Affects apache2 versions < 2.4.66-r0. Fixed in 2.4.66-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that provides a robust and flexible platform for hosting websites. It supports various features including dynamic content generation, URL redirection, and access control. However, certain configurations, particularly involving the mod_userdir and suexec modules, can lead to security vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2025-66200 allows users with access to the RequestHeader directive in htaccess files to bypass the intended user ID restrictions. This can result in CGI scripts executing under an unexpected user ID, potentially leading to unauthorized access to sensitive data or system resources. The issue affects Apache HTTP Server versions from 2.4.7 to 2.4.65, making it critical for users of these versions to take immediate action.
How To Fix
Minimum fixed version
2.4.66-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the RequestHeader directive in their htaccess files or disable the mod_userdir module if it is not needed. This can help mitigate the risk until an upgrade is performed.
Conclusion
CVE-2025-66200 represents a significant security risk for users of Apache HTTP Server versions 2.4.7 to 2.4.65. It is crucial to upgrade to version 2.4.66 or later to mitigate this vulnerability. Users should also consider temporary workarounds while planning for an upgrade.
See every vulnerability recorded for apache2 →
FAQ
CVE-2025-66200 is a vulnerability in Apache HTTP Server that allows unauthorized execution of CGI scripts under unexpected user IDs due to misconfigured htaccess files.
The vulnerability affects Apache HTTP Server versions from 2.4.7 to 2.4.65.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2025-66200 is 5.4, indicating a moderate level of severity.
If an immediate upgrade is not possible, consider implementing workarounds such as restricting access to the RequestHeader directive in htaccess files.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
