Apache HTTP Server Command Injection Vulnerability

🗓️ 10 Dec 2025 00:00:00Reported by China National Vulnerability DatabaseType

Apache Web Server versions before 2.4.66 have a command injection flaw in mod_cgid via shell escaped queries.

Reporter	Title	Published	Views	Family All 260
IBM Security Bulletins	Security Bulletin: Vulnerabilities in httpd library (CVE-2025-58098, CVE-2025-65082, CVE-2025-66200) affect Power HMC.	31 Mar 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.	8 Jun 202616:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	15 Dec 202515:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in httpd affects IBM Netezza Appliance	24 Apr 202608:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase [CVE-2025-66200, CVE-2025-59375, CVE-2025-65082, CVE-2025-59775, CVE-2025-58098]	4 Feb 202609:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System	9 Jul 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server shipped with IBM OpenPages is vulnerable to multiple vulnerabilities	18 Mar 202614:42	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	4 Dec 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2025-1318)	8 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2025-3099 (ALAS-2025-3099)	5 Jan 202600:00	–	nessus

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/12/04/5

12 Dec 2025 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.3

EPSS0.01527

SSVC