Vulnerability record · CVE-2025-55752 · published 27 October 2025
CVE-2025-55752: Apache Tomcat path traversal via URL rewrite bypasses WEB-INF protection
Apache · Tomcat
A regression in Apache Tomcat's URL rewrite handling normalizes the rewritten URL before decoding it, allowing an attacker to manipulate the request URI and bypass security constraints such as the protections for /WEB-INF/ and /META-INF/. If PUT is enabled, this can lead to upload of malicious files and remote code execution, though the vendor notes PUT is normally restricted to trusted users and unlikely to be enabled alongside the affected rewrite configuration.
Description
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityHigh CVSS (7.5) with a path traversal that can escalate to RCE when PUT is enabled, and very high EPSS despite no KEV listing.
What it is
A regression in Apache Tomcat's URL rewrite handling normalizes the rewritten URL before decoding it, allowing an attacker to manipulate the request URI and bypass security constraints such as the protections for /WEB-INF/ and /META-INF/. If PUT is enabled, this can lead to upload of malicious files and remote code execution, though the vendor notes PUT is normally restricted to trusted users and unlikely to be enabled alongside the affected rewrite configuration.
Impact
An attacker can reach protected paths under /WEB-INF/ and /META-INF/ and, where PUT is enabled, upload files that may execute as code, yielding remote code execution.
Attack surface
Reached over the network via crafted HTTP requests to a Tomcat instance using a rewrite rule that maps query parameters into the URL; the CVSS vector indicates low privileges are required and no user interaction.
Exploitation
Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.66535 (99.2nd percentile) and a third-party reference is tagged Exploit, indicating public exploit interest.
What to do
- Upgrade to Tomcat 11.0.11, 10.1.45, or 9.0.109 or later; EOL 8.5.x branches must be migrated off.
- Disable PUT requests unless strictly required, and restrict them to trusted users.
- Review and remove or harden rewrite rules that rewrite query parameters into the request URI.
- Restrict network exposure of Tomcat and enforce authentication on any management or upload endpoints.
Detection
- Inspect access logs for requests containing encoded traversal sequences or /WEB-INF/ and /META-INF/ paths reached via rewrite rules.
- Alert on PUT requests to Tomcat, especially those writing files outside expected upload directories.
- Monitor for newly created or modified files in web application directories and unexpected JSP or class file writes.
- Correlate rewrite-rule hits with anomalous URI patterns that differ between normalized and decoded forms.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog | Issue TrackingVendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/10/27/4 | Mailing ListThird Party Advisory |
| https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerability | ExploitThird Party Advisory |
| https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerability | MitigationThird Party Advisory |
| https://cert-portal.siemens.com/productcert/html/ssa-032379.html |
Track CVE-2025-55752 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-55752), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
