Apache Tomcat Partial PUT File Upload RCE (CVE-2025-24813)

CVE-2025-24813 is a partial PUT handling bug in Apache Tomcat that can allow attackers to upload or replace files in unexpected locations, leading to remote code execution when combined with writable webapp directories or session storage paths.

Affected Tomcat

• Apache Tomcat 11.0.0-M1 through 11.0.2
• Apache Tomcat 10.1.0-M1 through 10.1.34
• Apache Tomcat 9.0.0.M1 through 9.0.98
• Default servlet with write enabled (non-default but seen in misconfigs)

Verify deployment

/opt/tomcat/bin/version.sh
grep -R 'readonly' $CATALINA_HOME/conf/web.xml
systemctl status tomcat

Remediation

• Upgrade to Tomcat 11.0.3, 10.1.35, or 9.0.99+
• Set readonly=true on DefaultServlet unless uploads are required
• Run Tomcat as unprivileged user with read-only app base where possible
• Scan webapps for unexpected JSP/shell files after patch

Common on Linux Java stacks behind nginx reverse proxies.