Apache HTTP Server AllowOverride FileInfo Vulnerability

CVE-2025-66200

What is CVE-2025-66200?

A security flaw in the Apache HTTP Server allows unauthorized users to exploit the AllowOverride FileInfo directive. This vulnerability can enable CGI scripts to execute under unexpected user IDs when the RequestHeader directive is improperly configured in htaccess files. It primarily affects versions from 2.4.7 to 2.4.65. Users are urged to upgrade to version 2.4.66 or later to mitigate this risk.

References