Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Apache HTTP Server's mod_rewrite module incorrectly handles URL rewriting when the first part of a rewrite rule uses backreferences or variables, allowing attackers to access files on the server that shouldn't be publicly reachable. This can lead to running malicious code or exposing sensitive source code.

A flaw in mod_rewrite's output escaping (CWE-116) in Apache HTTP Server 2.4.59 and earlier allows path traversal when substitution rules begin with backreferences or variables in server context. An attacker can craft requests matching the rewrite pattern to bypass intended access restrictions and reach arbitrary filesystem locations served by the web server, enabling remote code execution or information disclosure.