CVE-2025-58098: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Overview

Severity

High (CVSS 8.3)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploit Status

Not Exploited

Patch Tuesday

2025-Dec

Released

2025-12-11

Last Updated

2025-12-20

EPSS Score

0.03% (percentile: 8.8%)

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 1 repositories

Affected Products (2)

Mariner

• azl3 httpd 2.4.65-1 on Azure Linux 3.0
• cbl2 httpd 2.4.65-1 on CBL Mariner 2.0

Revision History

• 2025-12-11: Information published.
• 2025-12-17: Information published.
• 2025-12-20: Information published.