CVE-2017-12617: Unrestricted Upload of File with Dangerous Type in Apache Tomcat
Summary
CVE-2017-12617: Unrestricted Upload of File with Dangerous Type Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 7.0.0, < 7.0.82
>= 8.0.0RC1, < 8.0.47
>= 8.5.0, < 8.5.23
>= 9.0.0.M1, < 9.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. The vulnerability in Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81 allows for the unrestricted upload of a file with a dangerous type. This means that an attacker can upload a JSP file to the server using a specially crafted request. Once uploaded, the JSP file can be requested, and any code it contains will be executed by the server.
Vulnerability Detail
The vulnerability arises when HTTP PUTs are enabled in Apache Tomcat. By setting the readonly initialization parameter of the Default servlet to false, an attacker can upload a JSP file to the server. This file can then be executed by the server, allowing the attacker to run arbitrary code. The impact of this vulnerability is significant as it enables remote code execution, potentially leading to unauthorized access, data breaches, and system compromise.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.827.0.82 -
>= 8.0.0RC1, < 8.0.478.0.47 -
>= 8.5.0, < 8.5.238.5.23 -
>= 9.0.0.M1, < 9.0.19.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround can be implemented by disabling HTTP PUTs in Apache Tomcat. This can be done by setting the readonly initialization parameter of the Default servlet to true. By doing so, the server will reject any attempts to upload files via HTTP PUT requests.
Conclusion
The unrestricted upload of a file with a dangerous type vulnerability in Apache Tomcat can lead to remote code execution and pose significant risks to the security and integrity of web applications. It is crucial to upgrade to a fixed version or implement the recommended workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows for the unrestricted upload of a file with a dangerous type, leading to remote code execution. This can result in unauthorized access, data breaches, and system compromise.
The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
Yes, a temporary workaround is to disable HTTP PUTs in Apache Tomcat by setting the readonly initialization parameter of the Default servlet to true.
Yes, the CVSS score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
