CVE-2025-24813: Apache Tomcat partial PUT path equivalence (RCE / file disclosure)

Exploited in the wild Critical 9.8 EPSS 99.9% Apache Tomcat

Tomcat's partial PUT used a temporary file named from the user-supplied path with '/' replaced by '.', so when writes are enabled on the default servlet an attacker can view or inject content into sensitive uploaded files, or reach remote code execution via file-based session persistence and a deserialization gadget library. Writes on the default servlet are off by default, so only servers that enabled them are exposed. Fixed in 11.0.3, 10.1.35 and 9.0.99; CISA added it to KEV on 1 April 2025 and notes it can be chained with CVE-2026-34486.

• CVE-2025-24813CVE identifier
• 9.8CVSS 3.1 base score (critical)
• 2025-04-01added to CISA's exploited list (US federal deadline 2025-04-22)
• 99.9%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
• 2025-03-10published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Apache Tomcat 11.0.0-M1 through 11.0.2
• Apache Tomcat 10.1.0-M1 through 10.1.34
• Apache Tomcat 9.0.0.M1 through 9.0.98
• Apache Tomcat 8.5.0 through 8.5.100 (end of life)

Fixed in:

• Apache Tomcat 11.0.3
• Apache Tomcat 10.1.35
• Apache Tomcat 9.0.99

Am I affected?

$CATALINA_HOME/bin/version.sh
dpkg -l 'tomcat*' | grep ^ii   # Debian/Ubuntu
rpm -q tomcat tomcat9   # RHEL
grep -n -A1 'readonly' $CATALINA_BASE/conf/web.xml   # writes are enabled only if the DefaultServlet readonly init-param is false

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade tomcat10   # or tomcat9 on Debian 11
sudo systemctl restart tomcat10

sudo apt update
sudo apt install --only-upgrade tomcat10 tomcat9   # Ubuntu Pro (ESM) for most releases
sudo systemctl restart tomcat10

sudo dnf upgrade tomcat
sudo systemctl restart tomcat

sudo dnf upgrade --refresh tomcat

sudo zypper refresh
sudo zypper update tomcat10 tomcat11 (or tomcat)

sudo dnf upgrade --releasever=latest tomcat10 tomcat11 (or tomcat9)

sudo pacman -Syu

not packaged: upstream tarball

pkg update && pkg upgrade tomcat101 tomcat110 (or tomcat9)

# install Apache Tomcat 11.0.3+, 10.1.35+ or 9.0.99+ from https://tomcat.apache.org/ and restart

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Keep the default servlet read-only: in conf/web.xml the DefaultServlet init-param readonly must be true (the default).
• Debian 12's tomcat9 source package (9.0.70-2) no longer ships the server, so only tomcat10 needs the fix there.

Related vulnerabilities

• CVE-2026-34486

Sources

• CVE record CVE-2025-24813
• NVD CVE-2025-24813
• CISA KEV entry CVE-2025-24813
• Debian security tracker CVE-2025-24813
• Ubuntu CVE page CVE-2025-24813
• Red Hat CVE page CVE-2025-24813
• Apache Tomcat announcement for CVE-2025-24813
• Apache Tomcat 9 security fixes
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.