CVE-2025-55752: Apache Tomcat relative path traversal in URL rewrite normalization

CVE-2025-55752 · Severity: high · CVSS 7.5 · Published 2025-10-27

Apache Tomcat, a widely used web server for Java applications, is vulnerable to a security flaw that could allow unauthorized access to protected system files. In specific configurations where URL rewriting is used, an attacker could bypass security restrictions to view sensitive internal directories or, in rare cases, upload malicious files to take control of the server. This could lead to data theft or a complete system compromise.

Technologies: org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven), Siemens SIMATIC CN 4100. Vendors: Maven, Siemens.

Quick answers

Is CVE-2025-55752 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-55752 being exploited in the wild.
How severe is CVE-2025-55752?
High severity, with a CVSS score of 7.5, published 27 October 2025.
Which products and versions are affected?
org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.11; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.11; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.11; Siemens SIMATIC CN 4100 All versions < V5.0.
Is there a fix for CVE-2025-55752?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.11 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.11 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55752 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-55752?
Check whether you run org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 11.0.11 or later
    # set org.apache.tomcat:tomcat to 11.0.11 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.11 or later
    # set org.apache.tomcat:tomcat-catalina to 11.0.11 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.11 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.11 in your pom.xml or build.gradle

Technical details

A regression in the fix for bug 60013 causes rewritten URLs to be normalized before they are decoded. In environments using rewrite rules that map query parameters to the URL, an attacker can craft a request URI that bypasses security constraints, specifically protecting the /WEB-INF/ and /META-INF/ directories. If the server also has PUT requests enabled (typically restricted to trusted users), this path traversal can be leveraged to upload malicious files, leading to remote code execution. The vulnerability is reachable over the network but requires specific configuration conditions to be exploitable. Patches are available in versions 11.0.11, 10.1.45, and 9.0.109.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, 8.5.6 through 8.5.100

Identifiers

  • CVE-2025-55752
  • GHSA-wmwf-9ccg-fff5

Timeline

  • 2025-10-27: disclosed
  • 2025-10-27: advisory
  • 2025-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.