CVE-2025-55752
Apache Tomcat: relative path traversal via rewrite rules
Technology
Apache Tomcat
CVSS Score
7.5 / 10.0
Affected Versions
11.0.0-M1 to 11.0.10; 10.1.0-M1 to 10.1.44; 9.0.0.M11 to 9.0.108; NVD also lists 8.5.6 to 8.5.100
Upstream Fix
11.0.11; 10.1.45; 9.0.109
Published
October 27, 2025
OSSeva Coverage
Fixed upstream
Description
A regression from the fix for bug 60013 normalised the rewritten URL before decoding it, so for rewrite rules that move query parameters into the URL an attacker could bypass security constraints, including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled, malicious files could be uploaded, leading to remote code execution. Fixed in 11.0.11, 10.1.45 and 9.0.109.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.10; 10.1.0-M1 to 10.1.44; 9.0.0.M11 to 9.0.108; NVD also lists 8.5.6 to 8.5.100, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.10; 10.1.0-M1 to 10.1.44; 9.0.0.M11 to 9.0.108; NVD also lists 8.5.6 to 8.5.100?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?