CVE-2025-24813CRITICAL 9.8CISA KEVEPSS p100.0%
CVE-2025-24813Apache Tomcat Path Equivalence Vulnerability
Apache / Tomcat
Description
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
Scoring
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.94% probability of exploitation · percentile 100.0% · 2026-06-15T12:03:41Z |
| Published | 2025-03-10 |
| Last modified | 2025-10-23 |
CISA KEV entry
Added to KEV: 2025-04-01
Underlying weaknesses· 3
References
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
- http://www.openwall.com/lists/oss-security/2025/03/10/5
- https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html
- https://security.netapp.com/advisory/ntap-20250321-0001/
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability
3
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Path Equivalence: 'file.name' (Internal Dot)cwe-44 | 0% | live |
| Weakness | Deserialization of Untrusted Datacwe-502 | 0% | live |
| Weakness | Use of Incorrectly-Resolved Name or Referencecwe-706 | 0% | live |
(incoming)1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| KEVEntry | Apache Tomcat Path Equivalence Vulnerabilitykev-cve-2025-24813 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.