{"id":"CVE-2025-24813","state":"PUBLISHED","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","publishedAt":"2025-03-10T16:44:03.715Z","updatedAt":"2025-10-29T11:49:44.413Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Tomcat"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","status":"affected","lessThanOrEqual":"11.0.2","versionType":"semver"},{"version":"10.1.0-M1","status":"affected","lessThanOrEqual":"10.1.34","versionType":"semver"},{"version":"9.0.0.M1","status":"affected","lessThanOrEqual":"9.0.98","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThanOrEqual":"8.5.100","versionType":"semver"},{"version":"3","status":"unknown","lessThan":"8.5.0","versionType":"semver"},{"version":"10.0.0-M1","status":"unknown","lessThanOrEqual":"10.0.27","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","http://www.openwall.com/lists/oss-security/2025/03/10/5","https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce","https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce","https://security.netapp.com/advisory/ntap-20250321-0001/","https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability","https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"],"weaknesses":["CWE-44","CWE-502"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24813.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-24813","state":"PUBLISHED","datePublished":"2025-03-10T16:44:03.715Z","dateUpdated":"2025-10-29T11:49:44.413Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2025-01-24T08:51:50.296Z"},"containers":{"cna":{"title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","descriptions":[{"lang":"en","value":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","status":"affected","lessThanOrEqual":"11.0.2","versionType":"semver"},{"version":"10.1.0-M1","status":"affected","lessThanOrEqual":"10.1.34","versionType":"semver"},{"version":"9.0.0.M1","status":"affected","lessThanOrEqual":"9.0.98","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThanOrEqual":"8.5.100","versionType":"semver"},{"version":"3","status":"unknown","lessThan":"8.5.0","versionType":"semver"},{"version":"10.0.0-M1","status":"unknown","lessThanOrEqual":"10.0.27","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-44","description":"CWE-44 Path Equivalence: 'file.name' (Internal Dot)","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2025-10-29T11:49:44.413Z"},"credits":[{"lang":"en","type":"finder","value":"COSCO Shipping Lines DIC"},{"lang":"en","type":"finder","value":"sw0rd1ight (https://github.com/sw0rd1ight)"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/03/10/5"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce"},{"url":"https://security.netapp.com/advisory/ntap-20250321-0001/"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-07-21T17:13:17.168Z"},"x_generator":{"engine":"ADPogram 0.0.1"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md","tags":["exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-24813","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-04-01T19:37:06.207441Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2025-04-01","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T22:55:25.563Z"},"timeline":[{"time":"2025-04-01T00:00:00.000Z","lang":"en","value":"CVE-2025-24813 added to CISA KEV"}]}]}}}