Critical Path Equivalence Vulnerability in Apache Tomcat Leading to Remote Code Execution
Summary
CVE-2025-24813: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. Affects tomcat10 across 2 version ranges.
< 10.1.34-0+deb12u2
< 7145107845fe82dafee783bb0bfd6bea028e173b
Fixed in 10.1.34-0+deb12u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The vulnerability identified as CVE-2025-24813 affects multiple versions of Tomcat, specifically versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98. This vulnerability arises from improper handling of file uploads, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, known as Path Equivalence, occurs due to the internal dot notation in file names, which can be exploited by malicious users. If certain conditions are met, an attacker can view sensitive files or inject malicious content into uploaded files. The conditions include having write access enabled for the default servlet, support for partial PUT requests, and knowledge of the names of sensitive files. Additionally, remote code execution can occur if the application uses Tomcat's file-based session persistence with default storage and includes libraries vulnerable to deserialization attacks.
How To Fix
Minimum fixed version
10.1.34-0+deb12u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable write access for the default servlet and disable support for partial PUT requests until the upgrade can be performed. This can be done by modifying the server configuration files to restrict these features.
Conclusion
The CVE-2025-24813 vulnerability in Apache Tomcat poses significant security risks, including remote code execution and information disclosure. Users are strongly advised to upgrade to the latest patched versions to protect their applications. Temporary workarounds can be implemented until an upgrade is feasible.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2025-24813 is a vulnerability in Apache Tomcat that allows for remote code execution and information disclosure due to improper handling of file uploads.
The affected versions include Apache Tomcat 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential remote code execution, and the possibility of injecting malicious content into uploaded files.
If an immediate upgrade is not possible, disable write access for the default servlet and support for partial PUT requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
