CVE-2025-24813: Apache Tomcat Path Equivalence RCE

CVE-2025-24813 is a path equivalence vulnerability in Apache Tomcat that exploits file path manipulation through the internal dot ('file.Name'). When the default servlet is configured with write enabled and partial PUT support is active (both enabled by default or through configuration), an attacker can bypass access restrictions, read sensitive data, or inject malicious code into uploaded files. The vulnerability affects Tomcat versions 9.0.0-M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2.

The vulnerability has a CVSS score of 9.8, classified as critical. Status is confirmed by National Vulnerability Database: the official description specifies the conditions necessary for exploitation (write enabled for default servlet, partial PUT enabled, and for RCE also file-based session persistence). In recent communications on social networks, the vulnerability is mentioned as having public exploits, but this information is not verified from official sources.

Defenders must upgrade immediately to Tomcat 9.0.99, 10.1.35, or 11.0.3. Before upgrading, verify the default servlet configuration: if write is not enabled (default configuration), RCE risk is reduced, but information disclosure and file modification remain possible if partial PUT is active and the default servlet serves sensitive uploads. Disabling write on the default servlet and/or disabling partial PUT are interim mitigations, but upgrade is necessary.

EOL versions of Tomcat 8.5.0 through 8.5.100 are known to be affected even though no longer supported. The attack mechanism exploits an anomaly in path resolution that allows a malicious user to circumvent file access restrictions through file name manipulation. This type of path traversal vulnerability is classic in environments with misconfigured web services.