CVE-2025-55752: Apache Tomcat remote code execution (CVSS 7.5)

Description

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Tomcat≥ 10.0.0 < 10.0.27 · ≥ 10.1.0 < 10.1.45 · ≥ 11.0.0 < 11.0.11 · ≥ 8.5.6 ≤ 8.5.100

Remediation

Fixed in

Apache Tomcat≥ 10.0.27

Patch & vendor advisories

https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog

References

https://cert-portal.siemens.com/productcert/html/ssa-032379.html
https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1togIssue TrackingVendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerabilityExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerabilityMitigationThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/10/27/4Mailing ListThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-55752 being actively exploited?

CVE-2025-55752 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 64.4%.

How severe is CVE-2025-55752?

CVE-2025-55752 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 64.4% probability of exploitation.

Which products are affected by CVE-2025-55752?

Affected products include Apache Tomcat.

How do I fix CVE-2025-55752?

Upgrade affected software to a fixed version, for example Apache Tomcat 10.0.27 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-55752 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo