Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Unknown

• https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
• http://www.openwall.com/lists/oss-security/2025/03/10/5
• https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html
• https://security.netapp.com/advisory/ntap-20250321-0001/
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce
• https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce
• https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md

• Apache » Tomcat » Version: 10.1.0
  cpe:2.3:a:apache:tomcat:10.1.0
• Apache » Tomcat » Version: 10.1.1
  cpe:2.3:a:apache:tomcat:10.1.1
• Apache » Tomcat » Version: 10.1.10
  cpe:2.3:a:apache:tomcat:10.1.10
• Apache » Tomcat » Version: 10.1.11
  cpe:2.3:a:apache:tomcat:10.1.11
• Apache » Tomcat » Version: 10.1.12
  cpe:2.3:a:apache:tomcat:10.1.12
• Apache » Tomcat » Version: 10.1.13
  cpe:2.3:a:apache:tomcat:10.1.13
• Apache » Tomcat » Version: 10.1.14
  cpe:2.3:a:apache:tomcat:10.1.14
• Apache » Tomcat » Version: 10.1.15
  cpe:2.3:a:apache:tomcat:10.1.15
• Apache » Tomcat » Version: 10.1.16
  cpe:2.3:a:apache:tomcat:10.1.16
• Apache » Tomcat » Version: 10.1.17
  cpe:2.3:a:apache:tomcat:10.1.17
• Apache » Tomcat » Version: 10.1.18
  cpe:2.3:a:apache:tomcat:10.1.18
• Apache » Tomcat » Version: 10.1.19
  cpe:2.3:a:apache:tomcat:10.1.19
• Apache » Tomcat » Version: 10.1.2
  cpe:2.3:a:apache:tomcat:10.1.2
• Apache » Tomcat » Version: 10.1.20
  cpe:2.3:a:apache:tomcat:10.1.20
• Apache » Tomcat » Version: 10.1.22
  cpe:2.3:a:apache:tomcat:10.1.22
• Apache » Tomcat » Version: 10.1.23
  cpe:2.3:a:apache:tomcat:10.1.23
• Apache » Tomcat » Version: 10.1.24
  cpe:2.3:a:apache:tomcat:10.1.24
• Apache » Tomcat » Version: 10.1.25
  cpe:2.3:a:apache:tomcat:10.1.25
• Apache » Tomcat » Version: 10.1.26
  cpe:2.3:a:apache:tomcat:10.1.26
• Apache » Tomcat » Version: 10.1.27
  cpe:2.3:a:apache:tomcat:10.1.27
• Apache » Tomcat » Version: 10.1.28
  cpe:2.3:a:apache:tomcat:10.1.28
• Apache » Tomcat » Version: 10.1.29
  cpe:2.3:a:apache:tomcat:10.1.29
• Apache » Tomcat » Version: 10.1.30
  cpe:2.3:a:apache:tomcat:10.1.30
• Apache » Tomcat » Version: 10.1.31
  cpe:2.3:a:apache:tomcat:10.1.31
• Apache » Tomcat » Version: 10.1.32
  cpe:2.3:a:apache:tomcat:10.1.32
• Apache » Tomcat » Version: 10.1.33
  cpe:2.3:a:apache:tomcat:10.1.33
• Apache » Tomcat » Version: 10.1.34
  cpe:2.3:a:apache:tomcat:10.1.34
• Apache » Tomcat » Version: 10.1.5
  cpe:2.3:a:apache:tomcat:10.1.5
• Apache » Tomcat » Version: 10.1.6
  cpe:2.3:a:apache:tomcat:10.1.6
• Apache » Tomcat » Version: 10.1.7
  cpe:2.3:a:apache:tomcat:10.1.7
• Apache » Tomcat » Version: 10.1.8
  cpe:2.3:a:apache:tomcat:10.1.8
• Apache » Tomcat » Version: 10.1.9
  cpe:2.3:a:apache:tomcat:10.1.9
• Apache » Tomcat » Version: 11.0.0
  cpe:2.3:a:apache:tomcat:11.0.0
• Apache » Tomcat » Version: 11.0.1
  cpe:2.3:a:apache:tomcat:11.0.1
• Apache » Tomcat » Version: 11.0.2
  cpe:2.3:a:apache:tomcat:11.0.2
• Apache » Tomcat » Version: 9.0.0
  cpe:2.3:a:apache:tomcat:9.0.0
• Apache » Tomcat » Version: 9.0.1
  cpe:2.3:a:apache:tomcat:9.0.1
• Apache » Tomcat » Version: 9.0.10
  cpe:2.3:a:apache:tomcat:9.0.10
• Apache » Tomcat » Version: 9.0.11
  cpe:2.3:a:apache:tomcat:9.0.11
• Apache » Tomcat » Version: 9.0.12
  cpe:2.3:a:apache:tomcat:9.0.12
• Apache » Tomcat » Version: 9.0.13
  cpe:2.3:a:apache:tomcat:9.0.13
• Apache » Tomcat » Version: 9.0.14
  cpe:2.3:a:apache:tomcat:9.0.14
• Apache » Tomcat » Version: 9.0.15
  cpe:2.3:a:apache:tomcat:9.0.15
• Apache » Tomcat » Version: 9.0.16
  cpe:2.3:a:apache:tomcat:9.0.16
• Apache » Tomcat » Version: 9.0.17
  cpe:2.3:a:apache:tomcat:9.0.17
• Apache » Tomcat » Version: 9.0.18
  cpe:2.3:a:apache:tomcat:9.0.18
• Apache » Tomcat » Version: 9.0.19
  cpe:2.3:a:apache:tomcat:9.0.19
• Apache » Tomcat » Version: 9.0.2
  cpe:2.3:a:apache:tomcat:9.0.2
• Apache » Tomcat » Version: 9.0.20
  cpe:2.3:a:apache:tomcat:9.0.20
• Apache » Tomcat » Version: 9.0.21
  cpe:2.3:a:apache:tomcat:9.0.21
• Apache » Tomcat » Version: 9.0.22
  cpe:2.3:a:apache:tomcat:9.0.22
• Apache » Tomcat » Version: 9.0.23
  cpe:2.3:a:apache:tomcat:9.0.23
• Apache » Tomcat » Version: 9.0.24
  cpe:2.3:a:apache:tomcat:9.0.24
• Apache » Tomcat » Version: 9.0.25
  cpe:2.3:a:apache:tomcat:9.0.25
• Apache » Tomcat » Version: 9.0.26
  cpe:2.3:a:apache:tomcat:9.0.26
• Apache » Tomcat » Version: 9.0.27
  cpe:2.3:a:apache:tomcat:9.0.27
• Apache » Tomcat » Version: 9.0.28
  cpe:2.3:a:apache:tomcat:9.0.28
• Apache » Tomcat » Version: 9.0.29
  cpe:2.3:a:apache:tomcat:9.0.29
• Apache » Tomcat » Version: 9.0.3
  cpe:2.3:a:apache:tomcat:9.0.3
• Apache » Tomcat » Version: 9.0.30
  cpe:2.3:a:apache:tomcat:9.0.30
• Apache » Tomcat » Version: 9.0.31
  cpe:2.3:a:apache:tomcat:9.0.31
• Apache » Tomcat » Version: 9.0.32
  cpe:2.3:a:apache:tomcat:9.0.32
• Apache » Tomcat » Version: 9.0.33
  cpe:2.3:a:apache:tomcat:9.0.33
• Apache » Tomcat » Version: 9.0.34
  cpe:2.3:a:apache:tomcat:9.0.34
• Apache » Tomcat » Version: 9.0.35
  cpe:2.3:a:apache:tomcat:9.0.35
• Apache » Tomcat » Version: 9.0.35-3.39.1
  cpe:2.3:a:apache:tomcat:9.0.35-3.39.1
• Apache » Tomcat » Version: 9.0.35-3.57.3
  cpe:2.3:a:apache:tomcat:9.0.35-3.57.3
• Apache » Tomcat » Version: 9.0.36
  cpe:2.3:a:apache:tomcat:9.0.36
• Apache » Tomcat » Version: 9.0.37
  cpe:2.3:a:apache:tomcat:9.0.37
• Apache » Tomcat » Version: 9.0.38
  cpe:2.3:a:apache:tomcat:9.0.38
• Apache » Tomcat » Version: 9.0.39
  cpe:2.3:a:apache:tomcat:9.0.39
• Apache » Tomcat » Version: 9.0.4
  cpe:2.3:a:apache:tomcat:9.0.4
• Apache » Tomcat » Version: 9.0.40
  cpe:2.3:a:apache:tomcat:9.0.40
• Apache » Tomcat » Version: 9.0.41
  cpe:2.3:a:apache:tomcat:9.0.41
• Apache » Tomcat » Version: 9.0.42
  cpe:2.3:a:apache:tomcat:9.0.42
• Apache » Tomcat » Version: 9.0.43
  cpe:2.3:a:apache:tomcat:9.0.43
• Apache » Tomcat » Version: 9.0.44
  cpe:2.3:a:apache:tomcat:9.0.44
• Apache » Tomcat » Version: 9.0.45
  cpe:2.3:a:apache:tomcat:9.0.45
• Apache » Tomcat » Version: 9.0.46
  cpe:2.3:a:apache:tomcat:9.0.46
• Apache » Tomcat » Version: 9.0.47
  cpe:2.3:a:apache:tomcat:9.0.47
• Apache » Tomcat » Version: 9.0.48
  cpe:2.3:a:apache:tomcat:9.0.48
• Apache » Tomcat » Version: 9.0.49
  cpe:2.3:a:apache:tomcat:9.0.49
• Apache » Tomcat » Version: 9.0.5
  cpe:2.3:a:apache:tomcat:9.0.5
• Apache » Tomcat » Version: 9.0.50
  cpe:2.3:a:apache:tomcat:9.0.50
• Apache » Tomcat » Version: 9.0.51
  cpe:2.3:a:apache:tomcat:9.0.51
• Apache » Tomcat » Version: 9.0.52
  cpe:2.3:a:apache:tomcat:9.0.52
• Apache » Tomcat » Version: 9.0.53
  cpe:2.3:a:apache:tomcat:9.0.53
• Apache » Tomcat » Version: 9.0.54
  cpe:2.3:a:apache:tomcat:9.0.54
• Apache » Tomcat » Version: 9.0.55
  cpe:2.3:a:apache:tomcat:9.0.55
• Apache » Tomcat » Version: 9.0.56
  cpe:2.3:a:apache:tomcat:9.0.56
• Apache » Tomcat » Version: 9.0.57
  cpe:2.3:a:apache:tomcat:9.0.57
• Apache » Tomcat » Version: 9.0.58
  cpe:2.3:a:apache:tomcat:9.0.58
• Apache » Tomcat » Version: 9.0.59
  cpe:2.3:a:apache:tomcat:9.0.59
• Apache » Tomcat » Version: 9.0.6
  cpe:2.3:a:apache:tomcat:9.0.6
• Apache » Tomcat » Version: 9.0.60
  cpe:2.3:a:apache:tomcat:9.0.60
• Apache » Tomcat » Version: 9.0.61
  cpe:2.3:a:apache:tomcat:9.0.61
• Apache » Tomcat » Version: 9.0.62
  cpe:2.3:a:apache:tomcat:9.0.62
• Apache » Tomcat » Version: 9.0.63
  cpe:2.3:a:apache:tomcat:9.0.63
• Apache » Tomcat » Version: 9.0.64
  cpe:2.3:a:apache:tomcat:9.0.64
• Apache » Tomcat » Version: 9.0.65
  cpe:2.3:a:apache:tomcat:9.0.65
• Apache » Tomcat » Version: 9.0.67
  cpe:2.3:a:apache:tomcat:9.0.67
• Apache » Tomcat » Version: 9.0.68
  cpe:2.3:a:apache:tomcat:9.0.68
• Apache » Tomcat » Version: 9.0.69
  cpe:2.3:a:apache:tomcat:9.0.69
• Apache » Tomcat » Version: 9.0.7
  cpe:2.3:a:apache:tomcat:9.0.7
• Apache » Tomcat » Version: 9.0.70
  cpe:2.3:a:apache:tomcat:9.0.70
• Apache » Tomcat » Version: 9.0.71
  cpe:2.3:a:apache:tomcat:9.0.71
• Apache » Tomcat » Version: 9.0.72
  cpe:2.3:a:apache:tomcat:9.0.72
• Apache » Tomcat » Version: 9.0.73
  cpe:2.3:a:apache:tomcat:9.0.73
• Apache » Tomcat » Version: 9.0.74
  cpe:2.3:a:apache:tomcat:9.0.74
• Apache » Tomcat » Version: 9.0.75
  cpe:2.3:a:apache:tomcat:9.0.75
• Apache » Tomcat » Version: 9.0.76
  cpe:2.3:a:apache:tomcat:9.0.76
• Apache » Tomcat » Version: 9.0.77
  cpe:2.3:a:apache:tomcat:9.0.77
• Apache » Tomcat » Version: 9.0.78
  cpe:2.3:a:apache:tomcat:9.0.78
• Apache » Tomcat » Version: 9.0.79
  cpe:2.3:a:apache:tomcat:9.0.79
• Apache » Tomcat » Version: 9.0.8
  cpe:2.3:a:apache:tomcat:9.0.8
• Apache » Tomcat » Version: 9.0.80
  cpe:2.3:a:apache:tomcat:9.0.80
• Apache » Tomcat » Version: 9.0.81
  cpe:2.3:a:apache:tomcat:9.0.81
• Apache » Tomcat » Version: 9.0.82
  cpe:2.3:a:apache:tomcat:9.0.82
• Apache » Tomcat » Version: 9.0.83
  cpe:2.3:a:apache:tomcat:9.0.83
• Apache » Tomcat » Version: 9.0.84
  cpe:2.3:a:apache:tomcat:9.0.84
• Apache » Tomcat » Version: 9.0.85
  cpe:2.3:a:apache:tomcat:9.0.85
• Apache » Tomcat » Version: 9.0.86
  cpe:2.3:a:apache:tomcat:9.0.86
• Apache » Tomcat » Version: 9.0.87
  cpe:2.3:a:apache:tomcat:9.0.87
• Apache » Tomcat » Version: 9.0.88
  cpe:2.3:a:apache:tomcat:9.0.88
• Apache » Tomcat » Version: 9.0.89
  cpe:2.3:a:apache:tomcat:9.0.89
• Apache » Tomcat » Version: 9.0.9
  cpe:2.3:a:apache:tomcat:9.0.9
• Apache » Tomcat » Version: 9.0.90
  cpe:2.3:a:apache:tomcat:9.0.90
• Apache » Tomcat » Version: 9.0.91
  cpe:2.3:a:apache:tomcat:9.0.91
• Apache » Tomcat » Version: 9.0.92
  cpe:2.3:a:apache:tomcat:9.0.92
• Apache » Tomcat » Version: 9.0.93
  cpe:2.3:a:apache:tomcat:9.0.93
• Apache » Tomcat » Version: 9.0.94
  cpe:2.3:a:apache:tomcat:9.0.94
• Apache » Tomcat » Version: 9.0.95
  cpe:2.3:a:apache:tomcat:9.0.95
• Apache » Tomcat » Version: 9.0.96
  cpe:2.3:a:apache:tomcat:9.0.96
• Apache » Tomcat » Version: 9.0.97
  cpe:2.3:a:apache:tomcat:9.0.97
• Apache » Tomcat » Version: 9.0.98
  cpe:2.3:a:apache:tomcat:9.0.98
• Debian » Debian Linux » Version: 11.0
  cpe:2.3:o:debian:debian_linux:11.0