Skip to content
OpenAdvisories
Critical · 10.0 Known exploited Scanner template Public exploit CVE-2025-24813 BIT-tomcat-2025-24813EUVD-2025-6498GHSA-83qj-6fr2-vhqg

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Published Mar 10, 2025 · Updated Oct 29, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tomcat10 Package: tomcat10 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.2, 10.1.0-M1 – ≤ 10.1.34, 9.0.0.M1 – ≤ 9.0.98, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.35-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.35-1 —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.34-0+deb12u2 DSA-5893-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.43-2~deb11u12 DLA-4108-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 tomcat9 9.0.70-2ubuntu2 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS tomcat10 10.1.16-1ubuntu0.1~esm1 USN-7525-1
Ubuntu Pro 24.04 LTS tomcat9 9.0.70-2ubuntu0.1+esm1 USN-7525-2
Ubuntu Pro 22.04 LTS tomcat9 9.0.58-1ubuntu0.2+esm2 USN-7525-1
Ubuntu Pro 20.04 LTS tomcat9 9.0.31-1ubuntu0.9+esm1 USN-7525-1
Ubuntu Pro 18.04 LTS tomcat9 9.0.16-3ubuntu0.18.04.2+esm6 USN-7525-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-1.el10_0 RHSA-2025:7497
RHEL 10 tomcat9 +7 1:9.0.87-5.el10_0 RHSA-2025:7494
RHEL 9 tomcat +7 1:9.0.87-2.el9_5.1 RHSA-2025:3645
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.3 RHSA-2025:3683
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.3 RHSA-2025:3647
RHEL 9.2 EUS tomcat +7 1:9.0.87-1.el9_2.3 RHSA-2025:3646
RHEL 8.8 EUS tomcat +7 1:9.0.87-1.el8_8.4 RHSA-2025:3684
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-6.redhat_00007.1.el8jws RHSA-2025:3608
Red Hat JBoss Web Server 6 jws6-tomcat-jakartaee-migration 1.0.6-2.redhat_00003.1.el8jws RHSA-2025:3608
Red Hat JBoss Web Server 6 jws6-tomcat-native 1.3.1-1.redhat_1.el8jws RHSA-2025:3608
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-8.redhat_00008.1.el7jws RHSA-2025:3454

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat +7 1:10.1.36-1.el10_0 ALSA-2025:7497
AlmaLinux 10 tomcat9 +7 1:9.0.87-5.el10_0 ALSA-2025:7494
AlmaLinux 9 tomcat +7 1:9.0.87-2.el9_5.1 ALSA-2025:3645
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.3 ALSA-2025:3683

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-1.el10_0 RLSA-2025:7497
Rocky Linux 10 tomcat9 1:9.0.87-5.el10_0 RLSA-2025:7494
Rocky Linux 9 tomcat 1:9.0.87-2.el9_5.1 RLSA-2025:3645
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.3 RLSA-2025:3683

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES 15 SP6 tomcat10 10.1.39-150200.5.36.1 SUSE-SU-2025:1024-1
SLES 15 SP5 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES 15 SP5 tomcat10 10.1.39-150200.5.36.1 SUSE-SU-2025:1024-1
SLES 15 SP4 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES 15 SP3 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES 12 SP5 tomcat 9.0.36-3.139.1 SUSE-SU-2026:1058-1, SUSE-SU-2025:0954-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES for SAP 15 SP5 tomcat10 10.1.39-150200.5.36.1 SUSE-SU-2025:1024-1
SLES for SAP 15 SP4 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLES for SAP 15 SP3 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLE HPC 15 SP5 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLE HPC 15 SP5 tomcat10 10.1.39-150200.5.36.1 SUSE-SU-2025:1024-1
SLE HPC 15 SP4 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SLE HPC 15 SP3 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SUSE Manager Server 4.3 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
SUSE Enterprise Storage 7.1 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.99-1.1 openSUSE-SU-2025:14896-1
openSUSE Tumbleweed tomcat10 10.1.35-1.1 openSUSE-SU-2025:14897-1
openSUSE Leap 15.6 tomcat 9.0.102-150200.78.1 SUSE-SU-2025:1126-1
openSUSE Leap 15.6 tomcat10 10.1.39-150200.5.36.1 SUSE-SU-2025:1024-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.39-1.amzn2023.0.1 ALAS2023-2025-910
Amazon Linux 2023 tomcat9 +7 1:9.0.102-1.amzn2023.0.1 ALAS2023-2025-911
Amazon Linux 2 tomcat +9 7.0.76-10.amzn2.0.10 ALAS2-2025-2812

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-1.el10_0 ELSA-2025-7497
Oracle Linux 10 tomcat9 +7 1:9.0.87-5.el10_0 ELSA-2025-7494
Oracle Linux 9 tomcat +7 1:9.0.87-2.el9_5.1 ELSA-2025-3645
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.3 ELSA-2025-3683

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard +4 3.9.1-r2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 59 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.3 11.0.3 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.35 10.1.35 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.99 9.0.99 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.3 11.0.3 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.35 10.1.35 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.99 9.0.99 GHSA-83qj-6fr2-vhqg
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-83qj-6fr2-vhqg

Advisories 44

References