CVE-2025-55752: Apache Tomcat Directory Traversal Vulnerability with Potential RCE
Summary
CVE-2025-55752: Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled. Affects tomcat across 3 version ranges.
< 9.0.109
>= 10.0.0, < 10.1.45
>= 11.0.0, < 11.0.11
Fixed in 9.0.109, 10.1.45 or 11.0.11, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
The same CVE-2025-55752 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. However, certain versions of Tomcat are susceptible to a directory traversal vulnerability that can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from a regression introduced in the fix for bug 60013, where the rewritten URL was normalized before decoding. This flaw allows attackers to manipulate the request URI to bypass security constraints, particularly protections for sensitive directories like /WEB-INF/ and /META-INF/. If the PUT method is enabled, attackers could upload malicious files, potentially leading to remote code execution (RCE). This vulnerability affects multiple versions of Apache Tomcat, specifically from 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, with older EOL versions also being at risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.0.1099.0.109 -
>= 10.0.0, < 10.1.4510.1.45 -
>= 11.0.0, < 11.0.1111.0.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately feasible, users should disable the PUT method for untrusted users to mitigate the risk of file uploads. This can typically be done by modifying the web.xml configuration file to restrict access to the PUT method.
Conclusion
The CVE-2025-55752 vulnerability in Apache Tomcat poses significant security risks due to its potential for directory traversal and remote code execution. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks effectively.
See every vulnerability recorded for tomcat →
FAQ
CVE-2025-55752 is a vulnerability in Apache Tomcat that allows for directory traversal and potential remote code execution if the PUT method is enabled.
The vulnerability affects Apache Tomcat versions from 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, as well as older EOL versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, disable the PUT method for untrusted users as a temporary workaround.
The risks include unauthorized access to sensitive files and the potential for remote code execution if malicious files are uploaded.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
