InfoSecBulletin Cybersecurity for mankind
A critical vulnerability, CVE-2025-24813, has been found in Apache Tomcat, which could let attackers execute remote code, leak sensitive data, or corrupt information. The Apache Software Foundation has released an urgent advisory, urging affected users to update right away.
Apache Tomcat, a popular open-source web server and servlet container, has a vulnerability related to how it handles partial PUT requests. The issue arises from its original implementation, which used a temporary file based on the user-provided file name and path, replacing separators with “.”.. This seemingly small oversight can lead to a major security risk in certain conditions.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
The advisory outlines two primary exploitation scenarios:
Information Disclosure and Corruption:
If writes are enabled for the default servlet (disabled by default), partial PUT support is active (enabled by default), a target URL for sensitive uploads is a subdirectory of a public upload URL, and an attacker knows the sensitive file names being uploaded via partial PUT, they can “view security sensitive files and/or inject content into those files.”
Remote Code Execution (RCE):
If writes are enabled for the default servlet, partial PUT is active, the application uses Tomcat’s file-based session persistence with the default storage, and the application includes a library vulnerable to deserialization attacks, “a malicious user was able to perform remote code execution.”
These scenarios demonstrate the serious risks, including unauthorized access to sensitive data and total server compromise.
The CVE-2025-24813 vulnerability affects the following Apache Tomcat versions:
Apache Tomcat 11.0.0-M1 to 11.0.2
Apache Tomcat 10.1.0-M1 to 10.1.34
Apache Tomcat 9.0.0.M1 to 9.0.98
The Apache Software Foundation advises users of these versions to take one of the following actions:
Upgrade to Apache Tomcat 11.0.3 or later.
Upgrade to Apache Tomcat 10.1.35 or later.
Upgrade to Apache Tomcat 9.0.99 or later.
This vulnerability poses a serious threat due to risks of data breaches and remote code execution. The default activation of the partial PUT feature in affected versions increases the danger. Many production servers could be at risk if not promptly patched.
Server administrators must quickly upgrade to the patched versions of affected Apache Tomcat to protect against this vulnerability.
