Introduction
Attackers can bypass security constraints and potentially access or upload files to protected directories in Apache Tomcat when specific rewrite rules are in use. The vulnerability, tracked as CVE-2025-55752, affects a broad range of Tomcat versions and comes from a regression in how Tomcat handles rewritten URLs. It matters most for organizations with custom rewrite configurations and for those that have enabled HTTP PUT requests.
Apache Tomcat runs a large share of enterprise and cloud Java applications worldwide, so a vulnerability in it can reach many industries, including critical infrastructure.
Technical Information
CVE-2025-55752 is a relative path traversal vulnerability in Apache Tomcat's RewriteValve. The root cause is a regression introduced by the fix for bug 60013, which changed the processing order so that rewritten URLs are normalized before they are decoded. An attacker can craft a request URI that, once certain rewrite rules process it (for example, rules that rewrite query parameters into the path), bypasses the security constraints that protect directories like /WEB-INF/ and /META-INF/.
The vulnerability is only exploitable when rewrite rules manipulate the URI in a way that interacts with path traversal sequences. Take a rule that rewrites a query parameter into the path. An attacker could abuse it with a request like /foo?bar=../WEB-INF/web.xml. After rewriting and normalization, that request could expose protected files if the decoding step reveals traversal sequences the security checks did not catch.
If HTTP PUT requests are enabled (they are not by default), an attacker could use this path traversal to upload malicious files to sensitive locations, which may lead to remote code execution. This escalation needs both a vulnerable rewrite configuration and PUT support on the DefaultServlet.
The vulnerability is classified under CWE-23 (Relative Path Traversal). The specific flaw is the normalization-before-decoding order, which leaves a window in which encoded traversal sequences can slip past the intended security checks.
Affected Systems and Versions
- Apache Tomcat 11.0.0-M1 through 11.0.10
- Apache Tomcat 10.1.0-M1 through 10.1.44
- Apache Tomcat 9.0.0.M11 through 9.0.108
- Apache Tomcat 8.5.6 through 8.5.100 (EOL as of March 31, 2024)
Vulnerable configurations include those with custom rewrite rules that rewrite query parameters into the URL path, or that otherwise manipulate the URI in a way that could introduce traversal sequences. The risk of exploitation rises if HTTP PUT requests are enabled on the DefaultServlet.
Vendor Security History
Apache Tomcat has a history of vulnerabilities in URL rewriting and path traversal, including regressions from previous fixes (such as bug 60013). The project maintains active security advisories and usually releases patches promptly. Supporting several major versions across many deployment configurations is complicated, though, and that complexity can lead to occasional regressions and delayed remediation for some users.
