VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 5, 2025· Updated Dec 5, 2025

Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

CVE-2025-66200

Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Affected products

2
  • Apache/HTTP Serverllm-fuzzy
    Range: >=2.4.7 <=2.4.65
  • Apache Software Foundation/Apache HTTP Serverv5
    Range: 2.4.7

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.