Critical Remote Code Execution Vulnerability Affecting Apache Tomcat
A critical remote code execution vulnerability has been uncovered in Apache Tomcat server instances configured with specific file upload or write handlers, allowing remote unauthenticated attackers to execute arbitrary code on the server.
Description
Technical context and vulnerability details
Apache Tomcat is an enterprise open-source implementation of Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies powering mission-critical web applications globally.
These products are affected by the following vulnerabilities:
CVE-2025-24813: Critical remote code execution vulnerability (CWE-94) arising from improper handling of concurrent upload requests. Under specific configurations, attackers can upload arbitrary executable scripts and trigger their execution. Classified Critical with a CVSS v3.1 base score of 9.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote code execution with the permissions of the Tomcat service account;
- Unauthorized access to web application source code, databases, and configuration files;
- Full server compromise and lateral movement inside internal DMZ networks.
Affected systems
Products, components and targeted versions
- Apache Tomcat 11.0: versions 11.0.0-M1 to 11.0.2;
- Apache Tomcat 10.1: versions 10.1.0-M1 to 10.1.34;
- Apache Tomcat 9.0: versions 9.0.0.M1 to 9.0.98.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Upgrade to Apache Tomcat 11.0.3, 10.1.35, or 9.0.99 or higher;
- Disable default write handlers and PUT methods if not strictly required;
- Restrict file system write permissions for the Tomcat operational user account.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.