CVE-2025-24813

Think of Apache Tomcat as the “front door” software that handles web requests for your applications. This bug is about a “partial upload” feature (partial PUT) and a default file-handling feature that can accidentally treat some uploaded data as if it belongs in the “wrong” place—like a delivery person putting a package into a confidential folder. In the worst case, it can lead to attackers stealing sensitive files or adding harmful content, and under additional conditions it may turn into remote code execution.

This matters to you if you run websites or apps on Apache Tomcat, especially if you’re on Apache Tomcat 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, or 9.0.0.M1 through 9.0.98 (and older affected, EOL versions like 8.5.0 through 8.5.100). It also affects Debian (Debian Linux) and other environments that bundle or ship Apache Tomcat, including NetApp Bootstrap OS. If you’re using Apache Tomcat via the Maven artifacts (org.apache.tomcat:tomcat-catalina and org.apache.tomcat.embed:tomcat-embed-core) or the listed Russian distributions (ООО «Ред Софт» РЕД ОС, АО «ИВК» Альт 8 СП, АО «ИВК» АЛЬТ СП 10), you should still treat it as relevant because it’s the same Tomcat component underneath.

This is RED because the bug is already listed as a known exploited issue and public exploits exist. The risk is high in the near term (very likely to be attacked soon) because attackers can use existing tools rather than needing rare luck. Even if you’re not sure your setup is vulnerable, the safest move for a small business is to patch right away.

1. Identify exposure

• Determine the exact Apache Tomcat version you run (including any packaged Tomcat in your environment).
• Confirm whether your version is within the affected ranges: 11.0.0-M1 through 11.0.2; 10.1.0-M1 through 10.1.34; 9.0.0.M1 through 9.0.98; also known affected EOL versions: 8.5.0 through 8.5.100.

2. Apply the fix (recommended)

• Upgrade to one of the patched versions:
  • 11.0.3
  • 10.1.35
  • 9.0.99

3. If you must temporarily mitigate

• Verify the Default Servlet configuration
  • Ensure Tomcat’s default servlet does not have “writes enabled” (it is described as disabled by default, but you must confirm it is not turned on).
• Check partial PUT exposure
  • Partial PUT is described as enabled by default; ensure your deployment and routing do not allow attackers to use partial PUT to target sub-directories where sensitive uploads could land.
• Review session storage setup (only relevant to the remote code execution path)
  • If you use Tomcat file-based session persistence, confirm it is not using Tomcat’s default storage location (as described in the conditions for remote code execution).
  • Also check whether your application includes a library that could be leveraged in a deserialization attack (the CVE lists this as part of the RCE condition).

4. After upgrading/mitigating

• Watch logs for suspicious upload/write patterns and unexpected file changes in application directories (especially areas related to uploads and session storage).
• Validate application behavior to ensure no other configuration changes broke required functionality.

5. Confirm with your vendor/stack

• If you’re on Debian or NetApp Bootstrap OS or using Maven Tomcat artifacts/embedded Tomcat, make sure you’re actually running the fixed Tomcat code (not just a nominal version change). Re-check the runtime version after deployment.

CVE-2025-24813 affects Apache Tomcat and can result in a combination of remote code execution (under additional conditions), information disclosure, and/or information corruption. The core issue is described as a “Path Equivalence: 'file.Name' (Internal Dot)” problem that allows attackers to target uploaded content handling in a way that can place or treat content incorrectly when certain features are enabled.

Affected versions:

• 11.0.0-M1 through 11.0.2
• 10.1.0-M1 through 10.1.34
• 9.0.0.M1 through 9.0.98
• Also known affected EOL versions: 8.5.0 through 8.5.100

Conditions described by the report:

• For information disclosure/information corruption via malicious content added to uploaded files:
  • Writes enabled for the default servlet (default servlet writes are “disabled by default”).
  • Partial PUT support enabled by default.
  • A target URL for security-sensitive uploads is a sub-directory of a target URL for public uploads.
  • Attacker knowledge of the names of security-sensitive files being uploaded.
  • The security-sensitive files are also uploaded via partial PUT.
• For remote code execution:
  • Writes enabled for the default servlet.
  • Partial PUT support enabled by default.
  • The application uses Tomcat’s file-based session persistence with the default storage location.
  • The application includes a library that may be leveraged in a deserialization attack.

Fix:

• Upgrade to 11.0.3, 10.1.35, or 9.0.99.

Exploitation context:

• Known exploited in the wild (CISA KEV): yes.
• Public exploit available: yes.
• Nuclei detection template exists: yes.
• Exploitation status from press: none (however, CISA KEV and public exploit availability indicate active threat tooling).

Severity/exploit likelihood:

• The provided CVSS is 9.8 (CRITICAL) and EPSS is 99.9% estimated probability of exploitation in the next 30 days.

Note on terminology:

• EPSS is an estimate of how likely exploitation is in a given time window.
• CISA KEV indicates vulnerabilities that CISA considers known to be exploited in the wild.