CVE-2025-55752
published 2025-10-27CVE-2025-55752: Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was…
PriorityP273high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
66.53%
99.2th percentile
Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.0.0 < 10.0.27 | 10.0.27 |
| apache | tomcat | >= 10.1.0 < 10.1.45 | 10.1.45 |
| apache | tomcat | >= 11.0.0 < 11.0.11 | 11.0.11 |
| apache | tomcat | 8.5.6 – 8.5.100 | — |
| apache | tomcat | >= 9.0.1 < 9.0.109 | 9.0.109 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.44 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.10 | — |
| apache_software_foundation | apache_tomcat | 8.5.6 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M11 – 9.0.108 | — |
| debian | tomcat10 | < tomcat10 10.1.52-1~deb12u1 (bookworm) | tomcat10 10.1.52-1~deb12u1 (bookworm) |
| debian | tomcat11 | < tomcat10 10.1.52-1~deb12u1 (bookworm) | tomcat10 10.1.52-1~deb12u1 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.52-1~deb12u1 (bookworm) | tomcat10 10.1.52-1~deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for HTTP PUT requests targeting paths that include encoded traversal sequences (e.g., %2F, %2E%2E) that, after normalization, resolve to /WEB-INF/ or /META-INF/ on Apache Tomcat instances. ↗
- →Monitor for requests where the rewritten URL path, after normalization, bypasses security constraints protecting /WEB-INF/ or /META-INF/ — indicative of the pre-decode normalization regression introduced by the fix for bug 60013. ↗
- →Flag HTTP PUT requests on Apache Tomcat versions 9.0.0.M11–9.0.108, 10.1.0-M1–10.1.44, 11.0.0-M1–11.0.10, and 8.5.6–8.5.100 where the request URI contains query parameters being rewritten into the URL path. ↗
- →Review Tomcat rewrite configurations for rules that rewrite query parameters into the URL path, as these are the prerequisite condition for exploitation of this traversal bypass. ↗
- →Monitor for unexpected file uploads via HTTP PUT to Tomcat deployments, especially where URL rewriting is active — successful exploitation could result in remote code execution via uploaded malicious files. ↗
- ·Exploitation requires BOTH URL rewrite rules that manipulate the request path AND HTTP PUT enabled — neither condition alone is sufficient. PUT is non-default and typically restricted to trusted/admin users. ↗
- ·The vulnerability is only triggered by specific rewrite rules that rewrite query parameters into the URL path; generic rewrite rules that do not touch the path are not exploitable. ↗
- ·The flaw is a regression introduced by the fix for Tomcat bug 60013, meaning only versions that include that fix (within the affected ranges) are vulnerable. ↗
- ·Red Hat rates this Important (not Critical) due to the non-default configuration requirements; standard Tomcat deployments with PUT disabled or tightly controlled are not at significant risk. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
vendor_redhat·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CWE-23 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects
Debian
CVE-2025-55752: tomcat10 - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 i...
vendor_debian·2025·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752: tomcat10 - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 i...
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108
GHSA
Apache Tomcat Vulnerable to Relative Path Traversal
ghsa·2025-10-27
CVE-2025-55752 [HIGH] CWE-23 Apache Tomcat Vulnerable to Relative Path Traversal
Apache Tomcat Vulnerable to Relative Path Traversal
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.
OSV
CVE-2025-55752: Relative Path Traversal vulnerability in Apache Tomcat
osv·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752: Relative Path Traversal vulnerability in Apache Tomcat
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108
OSV
Apache Tomcat Vulnerable to Relative Path Traversal
osv·2025-10-27
CVE-2025-55752 [HIGH] Apache Tomcat Vulnerable to Relative Path Traversal
Apache Tomcat Vulnerable to Relative Path Traversal
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-55752 tomcat: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 tomcat: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
CVE-2025-55752 tomcat: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Bugzilla
CVE-2025-55752 mod_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 mod_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
CVE-2025-55752 mod_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-55752 dogtag-pki: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 dogtag-pki: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
CVE-2025-55752 dogtag-pki: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy t
Bugzilla
CVE-2025-55752 jss: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 jss: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
CVE-2025-55752 jss: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close
Bugzilla
CVE-2025-55752 mod_proxy_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 mod_proxy_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
CVE-2025-55752 mod_proxy_cluster: Apache Tomcat: Directory traversal via rewrite with possible RCE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's p
Bugzilla
CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
bugzilla·2025-10-27·CVSS 7.5
CVE-2025-55752 [HIGH] CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
T
https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1toghttp://www.openwall.com/lists/oss-security/2025/10/27/4https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerabilityhttps://cert-portal.siemens.com/productcert/html/ssa-032379.html
2025-10-27
Published