CVE-2004-0173: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 15.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.

Affected products

• Apache HTTP Server: version 0.8.11 only; version 0.8.14 only; version 1.0 only; version 1.0.2 only; version 1.0.3 only; version 1.0.5 only; …

Published 2004-04-15. Last modified 2026-06-16.