Apache Tomcat Default Servlet Path Equivalence Vulnerability Leading to Remote Code Execution and Information Disclosure (CVE-2025-24813)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.
Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.
Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrading to the latest secure release is the recommended resolution. Use the following commands to download and deploy the patched version of Tomcat.
# Check current Tomcat version
/usr/share/tomcat/bin/version.sh
# Download and extract the secure version (e.g., Tomcat 10.1.35)
wget https://archive.apache.org/dist/tomcat/tomcat-10/v10.1.35/bin/apache-tomcat-10.1.35.tar.gz
tar -zxvf apache-tomcat-10.1.35.tar.gz -C /opt/
# Update symbolic link and restart service
ln -sfn /opt/apache-tomcat-10.1.35 /opt/tomcat
systemctl restart tomcat2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, ensure that the Default Servlet is configured as read-only in your web.xml file to block unauthorized write operations.
<!-- Edit /opt/tomcat/conf/web.xml -->
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<!-- Force readonly to true to disable PUT and DELETE methods -->
<init-param>
<param-name>readonly</param-name>
<param-value>true</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>3. Log Audit & IoC Verification Commands
Scan Tomcat access logs for suspicious PUT/DELETE requests and inspect the session storage directory for unexpected serialized files.
# Search access logs for PUT or DELETE requests targeting the application
grep -Ei '"(PUT|DELETE) .* HTTP/' /var/log/tomcat*/localhost_access_log*.txt
# Check for recently modified session files in the work directory
find /var/lib/tomcat*/work/ -name '*.session' -mtime -7 -lsBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-24813) stems from a Path Equivalence flaw (CWE-706) in Apache Tomcat's Default Servlet when processing file names containing an internal dot ('file.Name'). On certain file systems and operating systems, this internal dot causes path resolution discrepancies, allowing an attacker to bypass directory boundary checks. If the Default Servlet has write permissions enabled, this flaw can be leveraged to manipulate files outside the intended public directories.
2. Exploitation Mechanics & Attack Scenario
The exploitation vectors depend on the application's configuration:
Scenario A: Information Disclosure & File Injection
- Requires the Default Servlet to have write permissions enabled (
readonlyset tofalse) and partial PUT support enabled (default). - If the target directory for sensitive uploads is a subdirectory of the public upload directory, and the attacker knows the target file names, they can use partial PUT requests to overwrite or inject malicious content into those sensitive files.
Scenario B: Remote Code Execution (RCE)
- Requires write permissions enabled on the Default Servlet and partial PUT support enabled.
- The application must use Tomcat's file-based session persistence with the default storage location.
- The application must include a library vulnerable to deserialization attacks (CWE-502).
- The attacker uploads a serialized payload into the session storage directory via partial PUT and triggers deserialization by sending a request with the corresponding session ID, executing arbitrary code.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV list, this vulnerability poses an extreme risk. Successful exploitation allows unauthenticated remote attackers to execute arbitrary code under the privileges of the Tomcat process, potentially leading to full system compromise, data exfiltration, and lateral movement within the corporate network.
Official Vendor Advisories & References
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Frequently Asked SecOps Questions (CVE-2025-24813)
FAQQ1. How critical is CVE-2025-24813 and is it actively exploited in the wild?
CVE-2025-24813 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-24813?
Primary impacted vendors include apache across tomcat. Scope summary: Apache Tomcat 11.0.0-M1 to 11.0.2 (Fixed in 11.0.3) Apache Tomcat 10.1.0-M1 to 10.1.34 (Fixed in 10.1.35) Apache Tomcat 9.0.0.M1 to 9.0.98 (Fixed in 9.0.99) Apache Tomcat 8.5.0 to 8.5.100 (EOL, but vulnerable)
Q3. What temporary mitigations or workarounds exist for CVE-2025-24813 before patching?
[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-24813
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.