CVE-2025-66200: 
Apache HTTP Server vulnerability analysis and mitigation

CVE-2025-66200 is a mod_userdir+suexec bypass vulnerability in Apache HTTP Server, classified as an authentication bypass using an alternate path or channel (CWE-288). It affects Apache HTTP Server versions 2.4.7 through 2.4.65, and was reported by Mattias Åsander of Umeå University on November 19, 2025, with a fix committed on December 1, 2025, and publicly disclosed on December 4–5, 2025. The vulnerability allows authenticated users with .htaccess modification rights to cause CGI scripts to execute under an unintended user ID, bypassing the suexec security model. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, OSS-Security).

The root cause is improper handling of the RequestHeader directive within .htaccess files when both mod_userdir and suexec are enabled and AllowOverride FileInfo is configured. When a user with .htaccess write access uses the RequestHeader directive to manipulate HTTP headers, the suexec mechanism can be tricked into running CGI scripts under a different user ID than intended — bypassing the per-user execution isolation that suexec is designed to enforce. This is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The vulnerability was fixed in Apache HTTP Server 2.4.66 via revision r1930168 (OSS-Security, Apache Advisory).

Successful exploitation allows an authenticated user with .htaccess modification permissions to cause CGI scripts to execute under an unexpected user ID, enabling privilege escalation or lateral movement on the affected system. The integrity and availability of the server are at risk (CVSS integrity and availability impacts both rated Low), while confidentiality is not directly impacted. In multi-tenant hosting environments where mod_userdir and suexec are used to isolate user accounts, this vulnerability could allow one user to interfere with or impersonate another user's CGI execution context (Feedly, OSS-Security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access and the ability to write .htaccess files, limiting the attack surface to users with existing server-side permissions. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify target configuration: Confirm the target Apache HTTP Server (versions 2.4.7–2.4.65) has both mod_userdir and suexec enabled, and that AllowOverride FileInfo (or broader) is set for a directory accessible to the attacker.
2. Obtain .htaccess write access: Authenticate to the server as a user who has write access to a .htaccess file in a directory served by mod_userdir.
3. Craft malicious .htaccess: Add a RequestHeader directive to the .htaccess file that manipulates HTTP headers in a way that causes suexec to select an unintended user ID when executing CGI scripts in that directory.
4. Trigger CGI execution: Send an HTTP request to a CGI script within the affected directory. The manipulated headers cause suexec to run the CGI script under a different user ID than the directory owner.
5. Achieve privilege escalation: The CGI script executes with the privileges of the unintended user ID, potentially allowing access to files, processes, or resources belonging to another user on the system (OSS-Security, Apache Advisory).

The primary remediation is to upgrade Apache HTTP Server to version 2.4.66 or later, which contains the fix (Apache Advisory). As a workaround, administrators can restrict .htaccess permissions by setting AllowOverride None or removing FileInfo from AllowOverride, or by disabling the RequestHeader directive in .htaccess contexts. Disabling mod_userdir or suexec where not required also eliminates the attack surface. Downstream patches are available from Apple (macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4), IBM (Cloud Pak for Business Automation and Business Automation Workflow iFixes for April 2026), Red Hat, AlmaLinux, Rocky Linux, Debian, Ubuntu, Fedora, Slackware, Mageia, SUSE, and Amazon Linux (Apple macOS Sequoia, IBM Advisory, Red Hat).

The vulnerability was disclosed via the OSS-Security mailing list by Apache HTTP Server developer Eric Covener on December 4, 2025, crediting Mattias Åsander of Umeå University as the finder (OSS-Security). Coverage appeared on security news sites such as SecurityOnline.info and RedHotCyber, which noted the fix alongside other vulnerabilities addressed in Apache HTTP Server 2.4.66. The vulnerability received moderate attention given its medium severity rating and the requirement for authenticated access with .htaccess write permissions, limiting broader community alarm.