CVE-2025-66200

CVE Details

Release Date:	2025-12-05
Impact:	Moderate	What is this?

Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

See more information about CVE-2025-66200 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	5.4
Vector String:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	Low
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (httpd)	ELSA-2025-23932	2025-12-22
Oracle Linux version 9 (httpd)	ELSA-2025-23919	2025-12-22