CVE-2025-55752CWE-23

CVE-2025-55752

High ยท published October 27, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
64%
Percentile
99.2
In the wild
Unconfirmed
What it is

โšก A clever regression in Apache Tomcat means an attacker can manipulate URLs to access sensitive files โ€” and if PUT requests are enabled, that's a recipe for disaster! Think of it like a hotel with a sneaky backdoor โ€” while guests normally need a keycard to enter rooms, this flaw allows someone to bypass the front desk and access restricted areas like the staff-only zones. ๐Ÿ”‘ This could lead to unauthorized access to important configuration files or even malicious file uploads, resulting in full remote code execution! An attacker could essentially waltz right into your system and execute any command they desire, which is absolutely devastating for your security. ๐Ÿ˜ฑ

Put simply

Think of it like a hotel with a sneaky backdoor โ€” while guests normally need a keycard to enter rooms, this flaw allows someone to bypass the front desk and access restricted areas like the staff-only zones. ๐Ÿ”‘ This vulnerability arises from a regression in how Apache Tomcat normalizes and decodes rewritten URLs, allowing attackers to bypass security measures intended to protect sensitive directories like /WEB-INF/ and /META-INF/. If PUT requests are enabled, the potential for remote code execution increases significantly.

What to do

This could lead to unauthorized access to important configuration files or even malicious file uploads, resulting in full remote code execution! An attacker could essentially waltz right into your system and execute any command they desire, which is absolutely devastating for your security. ๐Ÿ˜ฑ To protect your system, upgrade to Apache Tomcat version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later immediately. Additionally, it's wise to review your configuration settings to ensure PUT requests are appropriately restricted. ๐Ÿ›ก๏ธ You've got this! Just follow these steps, and you'll have your Tomcat secure again in no time! ๐Ÿš€

The record
Technical detail
CVSS v3.1
7.5 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.64413 ยท 99.2th percentile
Weakness
CWE-23 ยท Relative Path Traversal
Published
2025-10-27T22:15Z
Affected products (23)
ProductVersionsFixed in
apache/tomcatโ‰ฅ 8.5.6, โ‰ค 8.5.100โ€”
apache/tomcatโ‰ฅ 9.0.1, < 9.0.1099.0.109
apache/tomcatโ‰ฅ 10.0.0, < 10.0.2710.0.27
apache/tomcatโ‰ฅ 10.1.0, < 10.1.4510.1.45
apache/tomcatโ‰ฅ 11.0.0, < 11.0.1111.0.11
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
apache/tomcatall versionsโ€”
References (5)
EPSS history
Timeline
  • 27 OCT 17:29Z
    Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
    cvelistv5