CVE-2025-24813
Apache Tomcat Path Equivalence Vulnerability
Description
CVE-2025-24813 is a critical path equivalence vulnerability in Apache Tomcat that can lead to remote code execution, information disclosure, or content injection. The vulnerability affects Tomcat versions 9.0.0.M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2, exploiting the interaction between the Default Servlet's write capability and partial PUT request support. With a CVSS v3.1 score of 9.8 and an EPSS score of 94.2% at the 100th percentile, this Apache Tomcat vulnerability was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 22, 2025, indicating active exploitation of one of the most widely deployed web application servers.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | < 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; 10.1.0; 11.0.0 |
| debian | debian linux | 11.0 |
| netapp | bootstrap os | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2025/03/10/5(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20250321-0001/(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce(Issue Tracking)
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce(Issue Tracking)
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability(Issue Tracking)
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability(Issue Tracking)
- https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813(Third Party Advisory, US Government Resource)
Weakness Type
CWE-44: Path Equivalence: Internal Dot
The primary weakness in CVE-2025-24813 involves path equivalence through internal dot handling, where the file name representation allows an attacker to access files through paths that circumvent security controls. In Apache Tomcat, the Default Servlet processes file names containing internal dots in a way that creates path equivalence, enabling access to files that should be protected.
Learn more: CWE-44 — Path Equivalence: Internal Dot
CWE-502: Deserialization of Untrusted Data
When combined with file-based session persistence, CVE-2025-24813 enables deserialization of untrusted data. An attacker can upload a malicious serialized Java object via partial PUT, which is then deserialized when loaded as a session file, achieving remote code execution.
Learn more: CWE-502 — Deserialization of Untrusted Data
CWE-706: Use of Incorrectly-Resolved Name or Reference
The vulnerability additionally involves incorrect name resolution where Tomcat resolves file paths in a way that maps attacker-controlled URLs to unintended filesystem locations, bypassing intended access restrictions.
Learn more: CWE-706 — Use of Incorrectly-Resolved Name or Reference
Impact Analysis
CVE-2025-24813 has the maximum practical CVSS v3.1 score of 9.8 (Critical), reflecting its severe exploitability and impact characteristics. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). Confidentiality, integrity, and availability are all rated High because the vulnerability enables three distinct attack outcomes depending on the server configuration. In the most severe scenario, when file-based session persistence is configured with the default storage location and a deserialization-capable library is present, an attacker achieves remote code execution with the privileges of the Tomcat process. Even without the RCE prerequisites, the vulnerability allows reading security-sensitive files and injecting content into uploaded files. The EPSS score of 94.2% at the 100th percentile places this in the top 0.1% of all CVEs by exploitation probability, reflecting the massive global deployment of Apache Tomcat and the availability of public proof-of-concept exploits.
Exploit Maturity
CVE-2025-24813 demonstrates maximum exploit maturity with widespread active exploitation confirmed. CISA has added it to the Known Exploited Vulnerabilities catalog, and public proof-of-concept exploit code is available via GitHub. The EPSS score of 94.2% at the 100th percentile — placing it in the top 0.1% of all vulnerabilities — indicates near-certain exploitation activity. The Apache Tomcat advisory was published alongside detailed technical information about the vulnerability conditions, and the open-source nature of Tomcat allows attackers to study the vulnerable code paths in detail. Given Tomcat's ubiquitous deployment across enterprise and cloud environments, mass scanning and exploitation campaigns began rapidly after disclosure.
Remediation
-
Upgrade Apache Tomcat immediately to version 9.0.99, 10.1.35, or 11.0.3 depending on your deployment branch. The Apache Tomcat security advisory provides the official fix details. End-of-life versions (8.5.x and earlier) should be migrated to a supported branch.
-
Disable writes for the Default Servlet if they are enabled (they are disabled by default). Check the
readonlyparameter in the Default Servlet configuration in web.xml. If set tofalse, either change it totrueor remove the parameter to restore the secure default. -
Disable partial PUT support if it is not required by your application. Partial PUT is enabled by default in Tomcat and is a prerequisite for this vulnerability. Configure the Default Servlet or a front-end reverse proxy to reject PUT requests with Content-Range headers.
-
Review session persistence configuration. If file-based session persistence is configured (PersistentManager with FileStore), switch to a database-backed session store or disable session persistence entirely. Ensure the session storage directory is not within any web-accessible path.
-
Deploy web application firewall (WAF) rules to detect and block exploitation attempts. Filter PUT requests containing internal dot patterns in file names, monitor for deserialization attack payloads in uploaded content, and implement strict upload path validation at the reverse proxy level.
Technical Details
CVE-2025-24813 is a path equivalence vulnerability in Apache Tomcat's Default Servlet that interacts with partial PUT support and file-based session persistence. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a fully unauthenticated, network-accessible attack with maximum impact. The vulnerability exploits the way Tomcat resolves file paths containing internal dots (e.g., "file.Name"). When the Default Servlet has writes enabled (readonly=false) and partial PUT is supported (the default), an attacker can upload content to specific filesystem locations by manipulating the path resolution logic. For information disclosure, the attacker exploits path equivalence to access files in security-sensitive subdirectories of public upload directories. For remote code execution, the attacker leverages file-based session persistence: Tomcat's PersistentManager with FileStore serializes session data to the filesystem using predictable file names. By uploading a malicious serialized Java object via partial PUT to a path that maps to the session storage location, the attacker can trigger deserialization when the session manager loads the file, executing arbitrary code through available deserialization gadget chains. The vulnerability spans Tomcat 9.0.0.M1 through 9.0.98, 10.1.0-M1 through 10.1.34, 11.0.0-M1 through 11.0.2, and EOL versions including 8.5.0 through 8.5.100.
Frequently Asked Questions
Is CVE-2025-24813 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2025-24813 to the KEV catalog. Public proof-of-concept exploit code is available on GitHub. The EPSS score of 94.2% at the 100th percentile places it in the top 0.1% of all vulnerabilities by exploitation likelihood.
What products are affected by CVE-2025-24813?
Apache Tomcat versions 9.0.0.M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2 are affected. End-of-life versions including 8.5.0 through 8.5.100 are also known to be vulnerable. Debian Linux 11 and NetApp Bootstrap OS are affected through bundled Tomcat installations.
How do I fix CVE-2025-24813?
Upgrade to Apache Tomcat 9.0.99, 10.1.35, or 11.0.3. As interim mitigations, disable Default Servlet writes (set readonly=true) and disable partial PUT support.
How severe is CVE-2025-24813?
CVE-2025-24813 is rated Critical with a CVSS score of 9.8. Under specific conditions (Default Servlet writes enabled, file-based session persistence), it enables unauthenticated remote code execution. Even without these conditions, it allows information disclosure and content injection. Its EPSS score of 94.2% makes it one of the most exploited vulnerabilities globally.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.