UpHeron
All vulnerabilities

Servers and applications

CVE-2025-24813

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 1 Apr 2025.

Severity
Critical 9.8
Published
10 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.99, 10.1.35, 11.0.3
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 11.0.1 before 11.0.3
  • Version 11.0.0-milestone25
  • Version 11.0.0-milestone24
  • Version 11.0.0-milestone23
All 48 release lines
  • Every version before 9.0.99
  • Version 10.1.0-milestone1
  • Version 10.1.0-milestone2
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone5
  • Version 10.1.0-milestone6
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone8
  • Version 10.1.0-milestone9
  • Version 10.1.0-milestone10
  • Version 10.1.0-milestone11
  • Version 10.1.0-milestone12
  • Version 10.1.0-milestone13
  • Version 10.1.0-milestone14
  • Version 10.1.0-milestone15
  • Version 10.1.0-milestone16
  • Version 10.1.0-milestone17
  • Version 10.1.0-milestone18
  • Version 10.1.0-milestone19
  • Version 10.1.0-milestone20
  • From 10.1.1 before 10.1.35
  • Version 11.0.0-milestone1
  • Version 11.0.0-milestone2
  • Version 11.0.0-milestone3
  • Version 11.0.0-milestone4
  • Version 11.0.0-milestone5
  • Version 11.0.0-milestone6
  • Version 11.0.0-milestone7
  • Version 11.0.0-milestone8
  • Version 11.0.0-milestone9
  • Version 11.0.0-milestone10
  • Version 11.0.0-milestone11
  • Version 11.0.0-milestone12
  • Version 11.0.0-milestone13
  • Version 11.0.0-milestone14
  • Version 11.0.0-milestone15
  • Version 11.0.0-milestone16
  • Version 11.0.0-milestone17
  • Version 11.0.0-milestone18
  • Version 11.0.0-milestone19
  • Version 11.0.0-milestone20
  • Version 11.0.0-milestone21
  • Version 11.0.0-milestone22
  • Version 11.0.0-milestone23
  • Version 11.0.0-milestone24
  • Version 11.0.0-milestone25
  • From 11.0.1 before 11.0.3

Known exploited

CISA name
Apache Tomcat Path Equivalence Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
22 Apr 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24813
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24813