CVE-2025-66200

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/04/8	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

History

18 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Elusión de mod_userdir+suexec mediante vulnerabilidad?AllowOverride?FileInfo en Servidor HTTP Apache. Los usuarios con acceso para usar la directiva?RequestHeader?en?.htaccess?pueden hacer que algunos scripts?CGI?se ejecuten bajo un?userid?inesperado. Este problema afecta a Servidor HTTP Apache: desde la versión?2.4.7?hasta la?2.4.65. Se recomienda a los usuarios actualizar a la versión?2.4.66, que corrige el problema.

Information

Published : 2025-12-05 11:15

Updated : 2026-10-18 14:10

NVD link : CVE-2025-66200

Mitre link : CVE-2025-66200

CVE.ORG link : CVE-2025-66200

JSON object : View

Products Affected

apache

http_server

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-66200", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66200", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T17:38:10.452304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache HTTP Server", "versions": [{"status": "affected", "version": "2.4.7", "versionType": "semver", "lessThanOrEqual": "2.4.65"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-05T11:15:52.747", "references": [{"url": "https://httpd.apache.org/security/vulnerabilities_24.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/04/8", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.\n\nThis issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes the issue."}, {"lang": "es", "value": "Elusi\u00f3n de mod_userdir+suexec mediante vulnerabilidad?AllowOverride?FileInfo en Servidor HTTP Apache. Los usuarios con acceso para usar la directiva?RequestHeader?en?.htaccess?pueden hacer que algunos scripts?CGI?se ejecuten bajo un?userid?inesperado. \n\nEste problema afecta a Servidor HTTP Apache: desde la versi\u00f3n?2.4.7?hasta la?2.4.65. \n\nSe recomienda a los usuarios actualizar a la versi\u00f3n?2.4.66, que corrige el problema."}], "lastModified": "2026-10-18T14:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B508363-1882-4DE9-B423-4FD35189171F", "versionEndExcluding": "2.4.66", "versionStartIncluding": "2.4.7"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}