{"id":"CVE-2025-24813","kind":"vulnerability","aliases":["CVE-2025-24813"],"related":[],"title":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or…","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","summary":"Apache Tomcat has a path equivalence flaw that lets a remote attacker reach or write files through a crafted partial PUT request. Attackers can run code, read information, or inject malicious content, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2025-04-01T00:00:00+00:00","products":[{"name":"apache tomcat","fixed":["9.0.99"],"affected":"< 9.0.99","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["10.1.35"],"affected":">= 10.1.1, < 10.1.35","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["11.0.3"],"affected":">= 11.0.1, < 11.0.3","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 10.1.0","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 11.0.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"netapp bootstrap os","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Apache Tomcat","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","runtime","self-hosted","tomcat"],"not_affected_if":["default-config"],"how_to_check":"Check the Tomcat version with the catalina.sh version command and look for a partial PUT enabled servlet (default write setting in conf/web.xml readonly=false).","fix":"Upgrade Apache Tomcat to a patched release per the Apache advisory; the sources do not name the fixed version.\nIf upgrade is not possible, follow vendor mitigations or disable the default servlet's write support (readonly=true) per CISA guidance.","status":"open","published_at":"2025-03-10T17:15:35+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:52+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T20:48:52Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Tomcat to a patched release per the Apache advisory; the sources do not name the fixed version.\nIf upgrade is not possible, follow vendor mitigations or disable the default servlet's write support (readonly=true) per CISA guidance.","reach":"internet","summary":"Apache Tomcat has a path equivalence flaw that lets a remote attacker reach or write files through a crafted partial PUT request. Attackers can run code, read information, or inject malicious content, and CISA lists it as actively exploited.","category":"runtime","who_cares":["tomcat","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker executes code on the server and reads or alters files.","analyst_note":"Confirm affected and fixed Tomcat version ranges and the exact default-servlet preconditions from the Apache Tomcat security advisory and the NVD entry for CVE-2025-24813.","how_to_check":"Check the Tomcat version with the catalina.sh version command and look for a partial PUT enabled servlet (default write setting in conf/web.xml readonly=false).\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000483,"input_tokens":2555,"output_tokens":454,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-24813':17A,20A '10.1.0':123C '10.1.34':126C '10.1.35':308C '11.0.0':118C '11.0.2':121C '11.0.3':307C '8.5.0':150C '8.5.100':152C '9.0.0':128C '9.0.98':131C '9.0.99':310C 'abl':172C,252C 'activ':82B 'add':100C 'affect':114C,149C,160C 'also':158C,235C 'and/or':11A,14A,94C,97C,178C 'apach':45B,110C,115C 'apache':21A,23A,25A,27A,29A,36A 'applic':274C,288C 'attack':56B,67B,220C,299C 'base':280C 'bootstrap':34A 'cisa':78B 'code':9A,70B,92C,256C 'content':76B,99C,180C 'craft':63B 'creat':143C 'cve':15A,18A,141C 'debian':31A 'default':107C,188C,192C,199C,262C,266C,273C,285C 'deseri':298C 'directori':212C 'disabl':190C,264C 'disclosur':13A,96C 'dot':5A,88C 'enabl':106C,185C,197C,259C,271C 'eol':136C,155C 'equival':2A,50B,85C 'execut':10A,93C,257C 'exploit':38B,83B 'file':60B,103C,177C,183C,228C,234C,279C 'file.name':3A,86C 'fix':312C 'flaw':51B 'follow':133C,165C,245C 'host':43B 'includ':289C 'inform':12A,72B,95C 'inject':74B,179C 'intern':4A,87C 'issu':113C,314C 'java':39B 'knowledg':221C 'known':146C 'lead':6A,89C 'let':53B 'leverag':295C 'librari':291C 'linux':32A 'list':79B 'locat':287C 'm1':119C,124C,129C 'malici':75B,98C,169C,249C 'may':157C,293C 'name':224C 'netapp':33A 'older':154C 'os':35A 'partial':64B,195C,239C,269C 'path':1A,49B,84C 'perform':254C 'persist':282C 'public':218C 'put':65B,196C,240C,270C 'reach':57B 'read':71B 'recommend':302C 'remot':8A,55B,91C,255C 'request':66B 'run':69B 'runtim':40B 'secur':175C,204C,226C,232C 'self':42B 'self-host':41B 'sensit':176C,205C,227C,233C 'servlet':108C,189C,263C 'session':281C 'storag':286C 'sub':211C 'sub-directori':210C 'support':193C,267C 'target':201C,215C 'though':151C 'time':139C 'tomcat':22A,24A,26A,28A,30A,37A,44B,46B,111C,116C,277C 'true':167C,247C 'upgrad':304C 'upload':102C,206C,219C,230C,237C 'url':202C,216C 'use':276C 'user':170C,250C,300C 'version':134C,156C,306C 'via':104C,238C 'view':174C 'write':59B,105C,184C,258C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-10T17:15:35+00:00","kev":{"dateAdded":"2025-04-01","dueDate":"2025-04-22","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-24813","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813","severity":null,"published_at":"2025-04-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-24813","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24813","severity":null,"published_at":"2025-03-10T17:15:35+00:00","modified_at":"2026-06-17T08:59:39+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}