The Apache Software Foundation has released a security update to patch a zero-day vulnerability in Apache HTTP Web Server that has been actively exploited in-the-wild. The vulnerability, tracked as CVE-2021-41773, is described as a path traversal and file disclosure flaw. The CVE advisory states that if this vulnerability is exploited, “An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts.” Path traversal attacks request access to the private web server directories, and if successful, they will bypass the filters that block for those types of requests. This flaw only affects servers running Apache version 2.4.49 with the require all denied access control parameter disabled (it is disabled by default), and the vulnerability can be mitigated by upgrading to Apache 2.4.50. If administrators cannot upgrade to the newest stable version, then they should enable the require all denied parameter within their access controls, and this will prevent exploitation of the vulnerability as well.