---
id: "CVE-2025-24813"
kind: "vulnerability"
aliases: ["CVE-2025-24813"]
title: "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "apache tomcat", "fixed": ["9.0.99"], "affected": "< 9.0.99", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.35"], "affected": ">= 10.1.1, < 10.1.35", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.3"], "affected": ">= 11.0.1, < 11.0.3", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 10.1.0", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 11.0.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "netapp bootstrap os", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Apache Tomcat", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["default-config"]
published_at: "2025-03-10T17:15:35+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or…

Apache Tomcat has a path equivalence flaw that lets a remote attacker reach or write files through a crafted partial PUT request. Attackers can run code, read information, or inject malicious content, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache tomcat affected < 9.0.99 fixed 9.0.99
- vendor:apache tomcat affected >= 10.1.1, < 10.1.35 fixed 10.1.35
- vendor:apache tomcat affected >= 11.0.1, < 11.0.3 fixed 11.0.3
- vendor:apache tomcat affected = 10.1.0 fixed ?
- vendor:apache tomcat affected = 11.0.0 fixed ?
- vendor:debian linux affected = 11.0 fixed ?
- vendor:netapp bootstrap os affected ? fixed ?
- vendor:Apache Tomcat affected ? fixed ?

## How to check

Check the Tomcat version with the catalina.sh version command and look for a partial PUT enabled servlet (default write setting in conf/web.xml readonly=false).

## Fix

Upgrade Apache Tomcat to a patched release per the Apache advisory; the sources do not name the fixed version.
If upgrade is not possible, follow vendor mitigations or disable the default servlet's write support (readonly=true) per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24813
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-24813

## From the sources

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to       perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_