CVE-2025-66200

MEDIUM 5.4CVE-2025-66200 · Published 05/12/2025 · updated 18/10/2026

In short

CVE-2025-66200 is a MEDIUM (CVSS 5.4) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.2% of all vulnerabilities.
Fix: update to 2.4.66 or later.

Package	Affected versions	Patched versions
http server apache	`≥ 2.4.7, < 2.4.66`	`2.4.66`

Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

References

httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
openwall.com/lists/oss-security/2025/12/04/8 · Issue Tracking

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

≥ 2.4.7, < 2.4.66

2.4.66

Description

More vulnerabilities in http server

See all →