CVE-2011-2767: Apache Mod Perl

Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days.

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

Affected products

• Apache Mod Perl: from 2.0.0, up to and including 2.0.10
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 8.0 only
• Red Hat Enterprise Linux: version 6.0 only; version 6.7 only; version 7.0 only; version 7.3 only; version 7.4 only; version 7.5 only; …
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Workstation: version 6.0 only

Published 2018-08-26. Last modified 2026-06-16.