CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability

CISA Known Exploited Vulnerabilities

Name

Apache Tomcat Path Equivalence Vulnerability

Vendor

Apache

Product

Tomcat

Added to the catalog

2025-04-01

Due date for US federal agencies

2025-04-22

Weaknesses

CWE-44, CWE-502

Catalog version

2026.10.30

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
• https://nvd.nist.gov/vuln/detail/CVE-2025-24813

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2025-03-10T17:15:35.067

Last modified

2026-06-17T08:59:39.593

Weaknesses

CWE-44, CWE-502, CWE-706

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.


If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

References

• https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq (Vendor Advisory)
• http://www.openwall.com/lists/oss-security/2025/03/10/5 (Mailing List, Third Party Advisory)
• https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html (Mailing List, Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20250321-0001/ (Third Party Advisory)
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce (Issue Tracking)
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce (Issue Tracking)
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability (Issue Tracking)
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability (Issue Tracking)
• https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md (Exploit)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813 (Third Party Advisory, US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:22.836Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-24813

CVE record

Title (CNA)

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Assigner

apache

State

PUBLISHED

Published

2025-03-10T16:44:03.715Z

Updated

2025-10-29T11:49:44.413Z

Problem types

CWE-44 Path Equivalence: 'file.name' (Internal Dot); CWE-502 Deserialization of Untrusted Data

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.


If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

References

• https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq

Read on 2026-11-03T02:15:25.144Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24813.json

GitHub Advisory Database

Also known as / affected packages

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/