CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
Low-severity CVE-2026-42356 can execute some non-CGI files in Apache HTTP Server CGI directories.
CVE-2026-42356 is a low-rated wrong-handler vulnerability in Apache HTTP Server 2.4.60 through 2.4.68. Some internal redirects originating from CGI programs can cause the redirect target to be treated as CGI and executed. The target must already be in a CGI-enabled directory and have no extension understood by mod_mime. The disclosure describes limited remote code execution under those conditions and does not report active exploitation.
- CVE-2026-42356 is a wrong-handler flaw enabling limited code execution.
- Some internal CGI redirects execute non-CGI files as CGI.
- Targets must already be in a CGI directory without a mod_mime extension.
- Apache HTTP Server 2.4.60 through 2.4.68 is affected and rated low.
Vulnerabilities mentionedAll →
- CVE-2026-423563.7—Wrong CGI handler on redirects in Apache HTTP Serverpublished · Apache Software Foundation Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42356 | Wrong CGI handler on redirects in Apache HTTP Server Apache HTTP Server 2.4.60 through 2.4.68 has a deployment-of-wrong-handler flaw (CWE-430) in how some internal redirects issued by CGI programs are handled. If the redirect target is already inside a directory enabled for CGI and has no filename extension that mod_mime understands, the server may treat that non-CGI file as CGI and execute it. An attacker who can influence such a redirect could gain limited unintended execution, with integrity impact only; the issue is rated CVSS 3.1 3.7 (network, high attack complexity, no privileges or user interaction). Only operators of those versions who actually use CGI are in scope; hosts without CGI-enabled directories are not exposed. No public proof of concept is known and the flaw is not in the CISA KEV catalog. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.60 through 2.4.68 Description: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68. Credit:...
This source does not provide full text. Read it at seclists.org.