This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apache Tomcat fixes a high-severity vulnerability

The Apache Software Foundation fixes a vulnerability in Apache Tomcat with versions 11.0.3, 10.1.35 and 9.0.99 [1]. The fix is also available in the Apache Tomcat GitHub repository in commit 0a668e0 [2].

Apache Tomcat - information disclosure/corruption, RCE (CVE-2025-24813)
CVSS 8.7 (High)

Due to insufficient path validation when processing partial PUT requests, an authenticated remote attacker can: i) read, modify or overwrite a potentially sensitive file if all of the following conditions are met – the default servlet has write enabled (disabled by default), partial PUT support is enabled (enabled by default), the target URL for uploading sensitive files is a subdirectory of the public upload URL, the attacker knows the names of the uploaded sensitive files, and these files are uploaded using partial PUT; or ii) execute code if all of the following conditions are met – the default servlet has write enabled, partial PUT support is enabled, and the application stores sessions in files (file-based session persistence) in the default storage and contains a library potentially vulnerable to deserialization attacks [1][3].

The vulnerability is present in product:

  • *:Apache Tomcat;>=11.0.0-M1,<=11.0.2;>=10.1.0-M1,<=10.1.34;>=9.0.0.M1,<=9.0.98;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 10. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 11. 3. 2025.

CESNET, z.s.p.o. Logo