CVE-2025-24813

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.2 Apache Tomcat versions 10.1.0-M1 through 10.1.34 Apache Tomcat versions 9.0.0.M1 through 9.0.98 Apache Tomcat versions 8.5.0 through 8.5.100

Description A path equivalence issue exists in the Default Servlet when it is enabled for writes, allowing an unauthenticated remote attacker to upload arbitrary files or execute arbitrary code. The flaw occurs because the server accepts input paths containing an internal dot without proper validation.

Remote code execution (RCE) is possible if the application uses file-based session persistence with the default storage location and includes a library susceptible to a deserialization attack. In this scenario, an attacker can send a PUT request containing a base64-encoded serialized Java payload to the session storage and subsequently trigger its execution via a GET request using a JSESSIONID cookie.

Information disclosure or malicious content injection occurs if writes are enabled for the default servlet, partial PUT is supported, and a target URL for sensitive uploads is a sub-directory of a public upload URL.

This issue is being actively exploited in the wild, with attackers utilizing proof-of-concept code to deploy backdoors and steal information.

Recommendations Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.2 to version 11.0.3. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.34 to version 10.1.35. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.98 to version 9.0.99. At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 8.5.0 through 8.5.100. As a temporary mitigation, set the readonly parameter to true for the Default Servlet. Disable partial PUT requests by setting the allowPartialPut parameter to false in the Default Servlet configuration. Avoid storing security-sensitive files in sub-directories of public upload paths.