Analysis Summary

CVE-2025-24813

Apache Tomcat could allow a remote attacker to execute arbitrary code on the system. The original implementation of partial PUT used a temporary file based on the user provided file name and path with the path separator replaced by ".". An attacker could exploit this vulnerability to view security sensitive files and/or inject content into those files and execute arbitrary code on the system.

Impact

• Code Execution

Indicators of Compromise

CVE

• CVE-2025-24813

Affected Vendors

Remediation

Upgrade to the latest version of Tomcat, available from the Apache Website.

Apache Website