CVE-2006-4110: Apache HTTP Server

Medium severity, CVSS 4.3. EPSS: 40% chance of exploitation in the next 30 days.

Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.

Affected products

• Apache HTTP Server: version 2.0.58 only; version 2.2.2 only; version 2.2.3 only

Published 2006-08-14. Last modified 2026-06-16.