CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 1 Apr 2025, 22 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 99.9%
EPSS score, percentile 100 of all scored records
- How severe?
- 10.0 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline 22 Apr 2025. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Affected
- 11.0.0-M1 through 11.0.2
- 10.1.0-M1 through 10.1.34
- 9.0.0.M1 through 9.0.98
- 8.5.0 through 8.5.100
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 22 April 2025.
Advisories and patches
Linked from CISA's catalog entry
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
- https://nvd.nist.gov/vuln/detail/CVE-2025-24813
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 11.0.0-M1 through 11.0.2 |
| Affected | 10.1.0-M1 through 10.1.34 |
| Affected | 9.0.0.M1 through 9.0.98 |
| Affected | 8.5.0 through 8.5.100 |
| Unknown | from 3 to before 8.5.0 |
| Unknown | 10.0.0-M1 through 10.0.27 |
Versions not listed are: unaffected.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2025-24813 to its Known Exploited Vulnerabilities (KEV) catalog on 1 Apr 2025.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 22 Apr 2025.
- The CVE record was published on 10 Mar 2025, 22 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 10.0 (Critical), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99.9% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 10 Mar 2025 | CVE record published |
| 1 Apr 2025 | Added to CISA KEV |
| 22 Apr 2025 | CISA due date for the required action |
| 29 Oct 2025 | CVE record last updated |
More exploited Apache vulnerabilities
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability
- CVE-2024-27348: Apache HugeGraph-Server Improper Access Control Vulnerability