High ยท published October 27, 2025
CVSS calls it high at 7.5. It sits in the 99.2th percentile for exploit probability.
โก A clever regression in Apache Tomcat means an attacker can manipulate URLs to access sensitive files โ and if PUT requests are enabled, that's a recipe for disaster! Think of it like a hotel with a sneaky backdoor โ while guests normally need a keycard to enter rooms, this flaw allows someone to bypass the front desk and access restricted areas like the staff-only zones. ๐ This could lead to unauthorized access to important configuration files or even malicious file uploads, resulting in full remote code execution! An attacker could essentially waltz right into your system and execute any command they desire, which is absolutely devastating for your security. ๐ฑ
Think of it like a hotel with a sneaky backdoor โ while guests normally need a keycard to enter rooms, this flaw allows someone to bypass the front desk and access restricted areas like the staff-only zones. ๐ This vulnerability arises from a regression in how Apache Tomcat normalizes and decodes rewritten URLs, allowing attackers to bypass security measures intended to protect sensitive directories like /WEB-INF/ and /META-INF/. If PUT requests are enabled, the potential for remote code execution increases significantly.
This could lead to unauthorized access to important configuration files or even malicious file uploads, resulting in full remote code execution! An attacker could essentially waltz right into your system and execute any command they desire, which is absolutely devastating for your security. ๐ฑ To protect your system, upgrade to Apache Tomcat version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later immediately. Additionally, it's wise to review your configuration settings to ensure PUT requests are appropriately restricted. ๐ก๏ธ You've got this! Just follow these steps, and you'll have your Tomcat secure again in no time! ๐
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | โฅ 8.5.6, โค 8.5.100 | โ |
| apache/tomcat | โฅ 9.0.1, < 9.0.109 | 9.0.109 |
| apache/tomcat | โฅ 10.0.0, < 10.0.27 | 10.0.27 |
| apache/tomcat | โฅ 10.1.0, < 10.1.45 | 10.1.45 |
| apache/tomcat | โฅ 11.0.0, < 11.0.11 | 11.0.11 |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |
| apache/tomcat | all versions | โ |