Apache Tomcat CVE-2025-24813 Vulnerability

Description

Path equivalence via internal dot in file names allows attackers with write-enabled default servlet and partial PUT to read sensitive files or inject malicious content, leading to remote code execution or information disclosure on Apache Tomcat 9.0.x, 10.1.x, and 11.0.x.

Outbreak Alert

FortiGuard Labs has identified ongoing attack attempts aimed at exploiting the recently discovered Apache Tomcat remote code execution vulnerability, CVE-2025-24813. If successful, attackers could gain access to sensitive security files, allowing them to view or inject arbitrary content and potentially execute code remotely on target systems.

View the full Outbreak Alert Report

Affected Applications

Apache Tomcat

References