CVE-2025-24813: Apache Tomcat path-equivalence flaw leading to RCE, actively exploited
The short version: Apache Tomcat has a path-equivalence flaw (CVE-2025-24813) that, on a server whose default servlet is configured for writes, lets an attacker view or inject security-sensitive files and — through unsafe deserialization of uploaded content — reach remote code execution. It's in CISA's KEV catalog. The dangerous configuration isn't the default, but where it's present, patch immediately. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — exploited, but gated on a non-default write-enabled servlet configuration |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.94% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-04-22 |
| Known exploited? | Yes — public proof-of-concept; CISA-listed as exploited |
| Vulnerability type | CWE-44 path equivalence + CWE-502 unsafe deserialization → information disclosure / content injection / remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Tomcat 11.0.0-M1–11.0.2 · 10.1.0-M1–10.1.34 · 9.0.0.M1–9.0.98 (8.5.x EOL also affected) |
| Fixed in | Tomcat 11.0.3 · 10.1.35 · 9.0.99 |
What you need to know
CVE-2025-24813 is a path-equivalence flaw in Apache Tomcat's default servlet. When the default servlet is configured to allow writes — which is not the default — an attacker can use crafted paths to view security-sensitive files or inject content into files. Where partial PUT and file-based session persistence are in play, the injected content is deserialized, and that unsafe deserialization is the route to remote code execution.
The practical shape of the risk:
- The precondition is a write-enabled default servlet. Stock Tomcat is not exposed; the risk appears where writes have been explicitly enabled.
- The impact ladder is real. From reading sensitive files, to tampering with them, to full code execution via deserialization.
- It's exploited and automatable. Public proof-of-concept code exists, and CISA lists it as exploited.
How serious we see it
Critical — exploited, with the practical exposure bounded by configuration.
The NVD base score is 9.8 because, in the vulnerable configuration, the endpoint chains to unauthenticated code execution. We call our real-world take High rather than Critical because reaching that outcome depends on a non-default setup — a write-enabled default servlet, partial PUT, and file-based sessions. Where that configuration exists, treat it as top-of-queue; it's in KEV for good reason. The reassuring part: the fix is published across all three supported branches, and you can confirm both your version and your servlet configuration quickly.
Recommendations
Straight from the Apache Tomcat security guidance and CISA:
- Patch now. Upgrade to Tomcat 11.0.3 / 10.1.35 / 9.0.99 or later.
- Check the risky configuration. Confirm whether the default servlet has writes enabled and whether partial PUT / file-based session persistence are in use — disable what you don't need.
- Hunt for prior use. Review logs for unusual PUT requests and crafted paths against the default servlet.
- If you find indicators, respond. Rotate credentials and secrets reachable from the host and investigate for lateral movement.
- Confirm your exposure first. Verify whether any internet-facing Tomcat runs an affected version.
How BreachRisk sees it
BreachRisk discovers internet-facing Tomcat servers from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, outside-in view means an affected Tomcat is already on your map, so you can go straight to checking version and configuration rather than finding out from someone else's proof-of-concept.