httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

🗓️ 23 Feb 2026 19:19:20Reported by RedHatType

Apache server with server side includes and mod cgid can inject commands via exec using shell escaped queries.

Reporter	Title	Published	Views	Family All 261
IBM Security Bulletins	Security Bulletin: Vulnerabilities in httpd library (CVE-2025-58098, CVE-2025-65082, CVE-2025-66200) affect Power HMC.	31 Mar 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.	8 Jun 202616:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	15 Dec 202515:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in httpd affects IBM Netezza Appliance	24 Apr 202608:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase [CVE-2025-66200, CVE-2025-59375, CVE-2025-65082, CVE-2025-59775, CVE-2025-58098]	4 Feb 202609:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System	9 Jul 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server shipped with IBM OpenPages is vulnerable to multiple vulnerabilities	18 Mar 202614:42	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	4 Dec 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2025-1318)	8 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2025-3099 (ALAS-2025-3099)	5 Jan 202600:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-58098
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-58098
cve	www.cve.org/CVERecord

08 Jul 2026 19:02Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.3

EPSS0.01527

SSVC