CVE-2025-24813

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.2 Apache Tomcat versions 10.1.0-M1 through 10.1.34 Apache Tomcat versions 9.0.0.M1 through 9.0.98 Apache Tomcat versions 8.5.0 through 8.5.100

Description This issue involves path equivalence where the use of an internal dot in a filename allows an unauthenticated remote attacker to bypass security checks. By sending a specially crafted PUT request containing a base64-encoded serialized Java payload, an attacker can upload arbitrary files to the server. If the application uses file-based session persistence with the default storage location, the attacker can then send a GET request with a JSESSIONID cookie pointing to the uploaded file, forcing the server to deserialize the data and execute arbitrary code. This flaw is under active exploitation in the wild.

Exploitation may occur under the following conditions:

Recommendations Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.2 to version 11.0.3. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.34 to version 10.1.35. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.98 to version 9.0.99. As a temporary mitigation, set the readonly parameter to true for the Default Servlet. As a temporary mitigation, set the allowPartialPut parameter to false for the Default Servlet. Avoid storing security-sensitive files in sub-directories of public upload paths.