Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2025-04-01 — agencies required to remediate by 2025-04-22
☕ Maven

CVE-2025-24813

CRITICAL

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Also known asBIT-tomcat-2025-24813GHSA-83qj-6fr2-vhqg
Published
Mar 10, 2025
Updated
Jul 15, 2026
Affected
8 pkgs
Patched
6 / 8
Exploits
22 known

EPSS Exploitation Probability

via FIRST.org ↗
99.9%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
92.4%94.9%97.5%100.0%94.2%99.9%Jan 26May 26Jul 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

8 pkgs affected
☕org.apache.tomcat:tomcat-catalina☕org.apache.tomcat:tomcat-catalina☕org.apache.tomcat:tomcat-catalina☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat.embed:tomcat-embed-core☕org.apache.tomcat:tomcat-catalina☕org.apache.tomcat.embed:tomcat-embed-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Affected Packages

8 total 6 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.tomcat:tomcat-catalina≥ 11.0.0-M1&&< 11.0.311.0.3
☕Mavenorg.apache.tomcat:tomcat-catalina≥ 10.1.0-M1&&< 10.1.3510.1.35
☕Mavenorg.apache.tomcat:tomcat-catalina≥ 9.0.0.M1&&< 9.0.999.0.99
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 11.0.0-M1&&< 11.0.311.0.3
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 10.1.0-M1&&< 10.1.3510.1.35
☕Mavenorg.apache.tomcat.embed:tomcat-embed-core≥ 9.0.0.M1&&< 9.0.999.0.99
Exploits & PoCs
22

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52134webappsmultiple

Apache Tomcat 11.0.3 - Remote Code Execution

by Al Baradi Joy · Apr 7, 2025

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat-catalina. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update org.apache.tomcat:tomcat-catalina to 11.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-24813 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether CVE-2025-24813 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2025-24813. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive
O3 Security · Impact-Aware SCA

Is CVE-2025-24813 in your dependencies?

O3 detects CVE-2025-24813 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works