CVE-2025-58098 describes a vulnerability in the Apache HTTP Server's handling of Server Side Includes (SSI) when enabled alongside mod_cgid. Specifically, mod_cgid passes the shell-escaped query string to #exec cmd="..." directives, potentially allowing command injection by an attacker. Red Hat's advisory (RHSA-2026:0075) confirms this affects Red Hat Hardened Images and related products. The vulnerability involves CWE-201 (Insertion of Sensitive Information Into Sent Data), CWE-918, CWE-150, and CWE-305. Red Hat has not released a patch or official fix due to challenges in providing a mitigation that meets their standards for usability and stability. The CVSS score from Red Hat is 7.1 (high), reflecting high confidentiality and integrity impact with low availability impact. No known exploits in the wild have been reported.

An attacker may be able to inject commands executed by the server via the SSI #exec cmd directive when mod_cgid is enabled, potentially leading to unauthorized command execution. This can result in exposure of sensitive information and compromise of system integrity. The impact is rated high by Red Hat due to confidentiality and integrity concerns, though availability impact is low. No active exploitation has been observed to date.

Currently, no official fix or patch is available from Red Hat that meets their criteria for deployment and stability. Red Hat advises monitoring their advisory for updates. Customers are recommended to evaluate the risk and consider disabling Server Side Includes or mod_cgid if feasible as a temporary mitigation. Red Hat also suggests consulting with Technical Account Managers for tailored guidance. Applying mitigations that do not meet Red Hat's standards may be possible but are not officially endorsed.