Apache Tomcat Partial PUT Remote Code Execution Vulnerability (CVE-2025-24813)

This exploit disclosure was originally published by Chaitin Security Emergency Response Center. Overview Apache Tomcat is an open-source Java Servlet container and web server that supports Java Servlets, JavaServer Pages (JSP), and other Java-based web applications. It is widely used for developing and deploying enterprise-level web applications. In March 2025, the Apache Foundation released a security advisory addressing a Remote Code Execution (RCE), information disclosure, or tampering vulnerability (CVE-2025-24813) in Tomcat. The vulnerability affects environments where Partial PUT and DefaultServlet write permissions are enabled, potentially allowing attackers to bypass path validation, access sensitive files, or write specific files to execute malicious code. As exploiting this vulnerability requires specific conditions, affected users should evaluate the risk based on their setup and determine whether an immediate fix is necessary.

Mar 14, 2025 - 12:21

Apache Tomcat Partial PUT Remote Code Execution Vulnerability (CVE-2025-24813)

This exploit disclosure was originally published by Chaitin Security Emergency Response Center.

Overview

Apache Tomcat is an open-source Java Servlet container and web server that supports Java Servlets, JavaServer Pages (JSP), and other Java-based web applications. It is widely used for developing and deploying enterprise-level web applications.

In March 2025, the Apache Foundation released a security advisory addressing a Remote Code Execution (RCE), information disclosure, or tampering vulnerability (CVE-2025-24813) in Tomcat. The vulnerability affects environments where Partial PUT and DefaultServlet write permissions are enabled, potentially allowing attackers to bypass path validation, access sensitive files, or write specific files to execute malicious code.

As exploiting this vulnerability requires specific conditions, affected users should evaluate the risk based on their setup and determine whether an immediate fix is necessary.