CVE-2025-58098 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=…
High CVSS: 8.3

CVE-2025-58098

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Vendor
Apache
Product
Http Server
CWE
CWE-201
Yayın Tarihi
2025-12-05 14:15:49
Güncelleme
2025-12-08 19:36:05
Source Identifier
security@apache.org
KEV Date Added
-

Kategoriler

CWE-201 Http Server HIGH Apache 2025

Referanslar

https://httpd.apache.org/security/vulnerabilities_24.html http://www.openwall.com/lists/oss-security/2025/12/04/5