CVE-2025-58098

HIGH 8.3CVE-2025-58098 · Published 05/12/2025 · updated 25/09/2026

In short

CVE-2025-58098 is a HIGH (CVSS 8.3) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.9% of all vulnerabilities.
Fix: update to 2.4.66 or later.

Package	Affected versions	Patched versions
http server apache	`< 2.4.66`	`2.4.66`

Description

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

References

httpd.apache.org/security/vulnerabilities_24.html · Mailing List
openwall.com/lists/oss-security/2025/12/04/5 · Mailing List

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

< 2.4.66

2.4.66

Description

More vulnerabilities in http server

See all →