Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-55752 BIT-tomcat-2025-55752EUVD-2025-36224GHSA-wmwf-9ccg-fff5

Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

Published Oct 27, 2025 · Updated May 12, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Relative Path Traversal vulnerability in Apache Tomcat.

The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.10, 10.1.0-M1 – ≤ 10.1.44, 9.0.0.M11 – ≤ 9.0.108, 8.5.6 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.46-1 —
Debian 14 tomcat11 11.0.11-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.52-1~deb13u1 DSA-6120-1
Debian 13 tomcat11 11.0.15-1~deb13u1 DSA-6121-1
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.52-1~deb12u1 DSA-6120-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.107-0+deb11u2 DLA-4468-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS tomcat10 No fix yet —
Ubuntu 25.10 tomcat10 +1 No fix yet —
Ubuntu 24.04 LTS tomcat10 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Ubuntu Pro 16.04 LTS tomcat8 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-3.el10_1.1 RHSA-2025:23050
RHEL 10 tomcat9 +7 1:9.0.87-8.el10_1.1 RHSA-2025:23052
RHEL 9 tomcat +7 1:9.0.87-6.el9_7.1 RHSA-2025:23049
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.7 RHSA-2025:23048
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS tomcat +7 1:10.1.36-1.el10_0.3 RHSA-2025:23051
RHEL 10.0 EUS tomcat9 +7 1:9.0.87-5.el10_0.4 RHSA-2025:23053
RHEL 9.6 EUS tomcat +7 1:9.0.87-3.el9_6.4 RHSA-2025:23044
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.7 RHSA-2025:23047
RHEL 9.2 E4S pki-servlet-engine +1 1:9.0.50-1.el9_2.3 RHSA-2026:0293
RHEL 9.2 E4S tomcat +7 1:9.0.87-1.el9_2.7 RHSA-2025:23046
RHEL 9.0 E4S pki-servlet-engine +1 1:9.0.43-4.el9_0.2 RHSA-2026:0292
RHEL 8.8 TUS tomcat +7 1:9.0.87-1.el8_8.8 RHSA-2025:23045
RHEL 8.8 E4S tomcat +7 1:9.0.87-1.el8_8.8 RHSA-2025:23045
RHEL 8.6 TUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 TUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 TUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 TUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 TUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 TUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 TUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 TUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 E4S bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 E4S jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 E4S python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 E4S slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 E4S velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 E4S xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 E4S xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2726
RHEL 8.6 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS fasterxml-oss-parent 69-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS jackson-bom +2 2.19.1-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jackson-databind +4 2.19.1-1.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jackson-parent 2.19.2-2.module+el8.6.0+23397+419fb810 RHSA-2026:2726
RHEL 8.6 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:2726
RHEL 8.6 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:2726
RHEL 8.6 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.6 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2726
RHEL 8.6 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2726
RHEL 8.4 EUS Long Life apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2724
RHEL 8.4 EUS Long Life bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life fasterxml-oss-parent 69-3.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-bom +5 2.19.1-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-core +1 2.19.1-2.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jackson-parent 2.19.2-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 EUS Long Life jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:2724
RHEL 8.4 EUS Long Life python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:2724
RHEL 8.4 EUS Long Life slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 EUS Long Life velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 EUS Long Life xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 EUS Long Life xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:2724
RHEL 8.4 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS fasterxml-oss-parent 69-3.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS jackson-bom +5 2.19.1-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jackson-core +1 2.19.1-2.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jackson-parent 2.19.2-1.module+el8.4.0+23391+b488e6bf RHSA-2026:2724
RHEL 8.4 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:2724
RHEL 8.4 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:2724
RHEL 8.4 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.4 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2724
RHEL 8.4 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2724
RHEL 8.2 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS fasterxml-oss-parent 69-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS jackson-bom +7 2.19.1-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS jackson-parent 2.19.2-1.module+el8.2.0+23390+7631bd3f RHSA-2026:2725
RHEL 8.2 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS pki-servlet-engine +1 1:9.0.7-16.module+el8.2.0+23940+b159abcc.3 RHSA-2026:2725
RHEL 8.2 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS resteasy 3.0.26-3.module+el8.2.0+23401+65186842 RHSA-2026:2725
RHEL 8.2 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:2725
RHEL 8.2 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
RHEL 8.2 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:2725
RHEL 8.2 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:2725
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-19.redhat_00018.1.el8jws RHSA-2025:19809
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-14.redhat_00013.1.el7jws RHSA-2025:22925
Red Hat Hardened Images 1 tomcat10 +9 10.1.54-1.hum1 RHSA-2026:8334
Red Hat Hardened Images 1 tomcat11 +7 11.0.21-0.1.hum1 RHSA-2026:6569

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat +7 1:10.1.36-3.el10_1.1 ALSA-2025:23050
AlmaLinux 10 tomcat9 +7 1:9.0.87-8.el10_1.1 ALSA-2025:23052
AlmaLinux 9 tomcat +7 1:9.0.87-6.el9_7.1 ALSA-2025:23049
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.7 ALSA-2025:23048

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-3.el10_1.1 RLSA-2025:23050
Rocky Linux 10 tomcat9 1:9.0.87-8.el10_1.1 RLSA-2025:23052
Rocky Linux 9 tomcat 1:9.0.87-6.el9_7.1 RLSA-2025:23049
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.7 RLSA-2025:23048

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES 15 SP7 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
SLES 15 SP7 tomcat11 11.0.13-150600.13.12.1 SUSE-SU-2025:4086-1
SLES 15 SP6 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES 15 SP6 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
SLES 15 SP6 tomcat11 11.0.13-150600.13.12.1 SUSE-SU-2025:4086-1
SLES 15 SP5 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES 15 SP5 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
SLES 15 SP4 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES 15 SP3 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.36-3.153.2 SUSE-SU-2026:1058-1, SUSE-SU-2025:4184-1
SLES for SAP 16.0 tomcat 9.0.111-160000.1.1 SUSE-SU-2026:20084-1
SLES for SAP 16.0 tomcat10 10.1.52-160000.1.1 SUSE-SU-2026:20982-1
SLES for SAP 16.0 tomcat11 11.0.13-160000.1.1 SUSE-SU-2025:21152-1
SLES for SAP 15 SP5 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES for SAP 15 SP5 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
SLES for SAP 15 SP4 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES for SAP 15 SP3 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLES 16.0 tomcat 9.0.111-160000.1.1 SUSE-SU-2026:20084-1
SLES 16.0 tomcat10 10.1.52-160000.1.1 SUSE-SU-2026:20982-1
SLES 16.0 tomcat11 11.0.13-160000.1.1 SUSE-SU-2025:21152-1
SLE HPC 15 SP5 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLE HPC 15 SP5 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
SLE HPC 15 SP4 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SLE HPC 15 SP3 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SUSE Manager Server LTS 4.3 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
SUSE Enterprise Storage 7.1 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.111-1.1 openSUSE-SU-2025:15716-1
openSUSE Tumbleweed tomcat10 10.1.48-1.1 openSUSE-SU-2025:15717-1
openSUSE Tumbleweed tomcat11 11.0.13-1.1 openSUSE-SU-2025:15718-1
openSUSE Leap 16.0 tomcat 9.0.111-160000.1.1 openSUSE-SU-2026:20034-1
openSUSE Leap 16.0 tomcat10 10.1.52-160000.1.1 openSUSE-SU-2026:20444-1
openSUSE Leap 16.0 tomcat11 11.0.13-160000.1.1 openSUSE-SU-2025:20106-1
openSUSE Leap 15.6 tomcat 9.0.111-150200.96.1 SUSE-SU-2025:4159-1
openSUSE Leap 15.6 tomcat10 10.1.48-150200.5.54.1 SUSE-SU-2025:4103-1
openSUSE Leap 15.6 tomcat11 11.0.13-150600.13.12.1 SUSE-SU-2025:4086-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.48-1.amzn2023.0.1 ALAS2023-2025-1280
Amazon Linux 2023 tomcat9 +7 1:9.0.111-1.amzn2023.0.1 ALAS2023-2025-1281

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-3.el10_1.1 ELSA-2025-23050
Oracle Linux 10 tomcat9 +7 1:9.0.87-8.el10_1.1 ELSA-2025-23052
Oracle Linux 9 tomcat +7 1:9.0.87-6.el9_7.1 ELSA-2025-23049
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.7 ELSA-2025-23048

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

  • masahiro331/CVE-2025-55752 ★ 13 · Oct 29, 2025
  • TAM-K592/CVE-2025-55752 ★ 13 · Oct 28, 2025

    CVE-2025-55752, Apache Tomcat that allows directory traversal via URL rewrite, and under certain conditions, leads to remote code execution (RCE) if HTTP PUT is enabled.

  • AuroraSec-Pivot/CVE-2025-55752 ★ 2 · Nov 4, 2025

    基于 Docker 的重现环境，用于复现 Apache Tomcat 10.1.44 中的路径遍历漏洞 CVE-2025-55752。本实验场景可以复现官网报道的RCE

  • xiaoqiMikko/tomcat85-check ★ 0 · Sep 1, 2026

    CVE-2025-55752:Tomcat 8.5 已 EOL,终版 8.5.100。Apache 逐条声明「8.5 也受影响」的 2025 CVE 有 14 条,其中 10 条在 NVD 按 8.5.100 查不到。离线单 jar,读 conf/ 判断你到底中了哪几条。

  • Jimmy01240397/CVE-2025-55752 ★ 0 · Feb 19, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.11 11.0.11 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.45 10.1.45 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat >= 9.0.0-M11, < 9.0.109 9.0.109 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat >= 8.5.6, <= 8.5.100 — GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.11 11.0.11 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.45 10.1.45 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0-M11, < 9.0.109 9.0.109 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat:tomcat-catalina >= 8.5.6, <= 8.5.100 — GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.11 11.0.11 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.45 10.1.45 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M11, < 9.0.109 9.0.109 GHSA-wmwf-9ccg-fff5
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.6, <= 8.5.100 — GHSA-wmwf-9ccg-fff5

Advisories 50

References