Poor escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier makes it possible for an attacker to map URLs to filesystem spots which can be permitted for being served from the server but will not be intentionally/directly reachable by any URL, leading to code execution or resource https://chanceshuhv.onzeblog.com/28245702/little-known-facts-about-apache-web-server-support