CVE-2013-4444: Apache Tomcat Unrestricted File Upload Vulnerability
Summary
CVE-2013-4444: Apache Tomcat Unrestricted file upload vulnerability. Affects org.apache.tomcat:tomcat versions >= 7.0, < 7.0.40. Fixed in 7.0.40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to execute Java servlets and render JavaServer Pages (JSPs). It provides a platform for running Java web applications and is widely used in enterprise environments. The vulnerability identified as CVE-2013-4444 affects Apache Tomcat versions 7.x before 7.0.40. This vulnerability arises in certain scenarios involving outdated java.io.File code and a custom JMX configuration. Attackers can exploit this vulnerability to upload and access a JSP file, thereby executing arbitrary code on the target system.
Vulnerability Detail
The unrestricted file upload vulnerability in Apache Tomcat allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. This vulnerability is possible due to outdated java.io.File code and a custom JMX configuration. By exploiting this vulnerability, attackers can upload malicious JSP files and execute arbitrary code on the target system. This can lead to complete compromise of the affected system, unauthorized access, data theft, and further exploitation of the compromised system.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.40
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Apache Tomcat is not immediately feasible, a temporary workaround can be implemented. This workaround involves disabling the custom JMX configuration and ensuring that the java.io.File code is up to date. By disabling the custom JMX configuration, the vulnerability can be mitigated to some extent. However, it is strongly recommended to upgrade to the latest version as soon as possible to fully address the vulnerability.
Conclusion
The Apache Tomcat unrestricted file upload vulnerability (CVE-2013-4444) poses a significant risk to systems running affected versions of Apache Tomcat. It allows remote attackers to execute arbitrary code, potentially leading to complete compromise of the affected system. To mitigate this vulnerability, it is crucial to upgrade to Apache Tomcat version 7.0.40 or later. Regularly updating and patching all software components is essential to maintain a secure environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows remote attackers to execute arbitrary code on the target system. This can lead to complete compromise of the affected system, unauthorized access, data theft, and further exploitation of the compromised system.
The vulnerability affects Apache Tomcat versions 7.x before 7.0.40.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache Tomcat installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this specific vulnerability.
Yes, there are known exploits for this vulnerability. Attackers can upload malicious JSP files and execute arbitrary code on the target system.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to Apache Tomcat version 7.0.40 or later to address the unrestricted file upload vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
