The Apache web server version 2.4.49 has been found to be vulnerable to a path traversal turned remote code execution (RCE) vulnerability. Given the identifier CVE-2021-41773, this bug is unique in the way it weaponizes a path traversal flaw. Normally a path traversal vulnerability allows attackers to view arbitrary files on the target machine. This can lead to exposure of sensitive data, such as password files, but does not usually allow for code execution. Security researchers found that using this vulnerability to target the CGI script directory allows arbitrary code execution. In web development, the Common Gateway Interface (CGI) allows developers to easily run scripts on the server. By placing the script in the CGI directory, the web server will automatically execute it when a user navigates to the script’s location. Using this technology, researchers found they can use the path traversal flaw to execute code by first navigating into the CGI directory and then navigating out of it to the path of the executable. The Apache foundation attempted to address this flaw in version 2.4.50, though the additional patch 2.4.51 was required to completely fix the issue.