CVE-2025-55752: Apache Tomcat Relative Path Traversal Vulnerability
Summary
CVE-2025-55752: Apache Tomcat Vulnerable to Relative Path Traversal. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 8.5.60, <= 8.5.100
>= 9.0.0-M11, < 9.0.109
>= 10.1.0-M1, < 10.1.45
>= 11.0.0-M1, < 11.0.11
Fixed in 9.0.109, 10.1.45 or 11.0.11, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2025-55752 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications. The software is known for its robustness, scalability, and support for various Java technologies. However, certain versions of Apache Tomcat are vulnerable to a relative path traversal issue, which can lead to unauthorized access to sensitive files and potential remote code execution.
Vulnerability Detail
The vulnerability arises from a regression introduced in the fix for bug 60013, where the rewritten URL was normalized before being decoded. This flaw allows attackers to manipulate the request URI, potentially bypassing security constraints that protect sensitive directories like /WEB-INF/ and /META-INF/. If PUT requests are enabled, this could lead to the upload of malicious files, resulting in remote code execution. The affected versions include Apache Tomcat from 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, with older EOL versions also being susceptible.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0-M11, < 9.0.1099.0.109 -
>= 10.1.0-M1, < 10.1.4510.1.45 -
>= 11.0.0-M1, < 11.0.1111.0.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately possible, consider disabling PUT requests for untrusted users or restricting access to sensitive directories until a patch can be applied.
Conclusion
In summary, CVE-2025-55752 is a significant vulnerability in Apache Tomcat that can lead to serious security risks if not addressed. Users are strongly encouraged to upgrade to the latest patched versions to mitigate these risks.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
CVE-2025-55752 is a vulnerability in Apache Tomcat that allows for relative path traversal, potentially leading to unauthorized access to sensitive files.
The vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, and 9.0.0.M11 through 9.0.108, as well as certain older EOL versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application's pom.xml without signing up at the Vulert playground.
If exploited, this vulnerability could allow attackers to bypass security constraints and upload malicious files, leading to remote code execution.
If an immediate upgrade is not possible, consider disabling PUT requests for untrusted users or restricting access to sensitive directories as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
