UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55752

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If…

Severity
High 7.5
Published
27 Oct 2025
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.109, 10.0.27, 10.1.45, 11.0.11
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 11.0.0 before 11.0.11
  • From 10.1.0 before 10.1.45
  • From 10.0.0 before 10.0.27
  • From 9.0.1 before 9.0.109
All 23 release lines
  • From 8.5.6 up to 8.5.100
  • Version 9.0.0
  • Version 9.0.0-milestone11
  • Version 9.0.0-milestone12
  • Version 9.0.0-milestone13
  • Version 9.0.0-milestone14
  • Version 9.0.0-milestone15
  • Version 9.0.0-milestone16
  • Version 9.0.0-milestone17
  • Version 9.0.0-milestone18
  • Version 9.0.0-milestone19
  • Version 9.0.0-milestone20
  • Version 9.0.0-milestone21
  • Version 9.0.0-milestone22
  • Version 9.0.0-milestone23
  • Version 9.0.0-milestone24
  • Version 9.0.0-milestone25
  • Version 9.0.0-milestone26
  • Version 9.0.0-milestone27
  • From 9.0.1 before 9.0.109
  • From 10.0.0 before 10.0.27
  • From 10.1.0 before 10.1.45
  • From 11.0.0 before 11.0.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55752
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55752