vulnerability
Apache HTTPD: CVE-2025-58098: Insertion of Sensitive Information Into Sent Data
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:P) | Dec 5, 2025 | Dec 8, 2025 | Mar 25, 2026 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:P)
Published
Dec 5, 2025
Added
Dec 8, 2025
Modified
Mar 25, 2026
Description
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.
This issue affects Apache HTTP Server before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
This issue affects Apache HTTP Server before 2.4.66.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Solution
apache-httpd-upgrade-latest
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.