Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Remediation

References

CVE-2025-66200

Related Vulnerabilities

WordPress Plugin Greenshift-animation and page builder blocks Cross-Site Scripting (4.8.8)

WordPress Plugin Form Vibes-Database Manager for Forms Unspecified Vulnerability (1.4.2)

WordPress Plugin YaySMTP-Simple WP SMTP Mail Cross-Site Scripting (2.4.5)

MySQL CVE-2016-5627 Vulnerability (CVE-2016-5627)

Magento Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-28584)

Severity

Medium

Classification

CVE-2025-66200 CWE-288 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Tags

Missing Update Known Vulnerabilities