Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-24813

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

CVSS 9.8 · CriticalBuzz score 69.8KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 69.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.9 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
24.9
11 evidence mentions in the snapshot
Diversity score
20.0
8 sources across 3 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
11 source links · newest first
  • The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)watchTowr Labs

    ootPrints has kept a fairly low profile, with minimal CVEs assigned to the product itself; the most recent was in 2014 (CVE-2025-24813 is for Tomcat, don't @ us). A tell? If we take that "tell", and combine it with an end-user comment we found on HackForums; “BMC Footprints has been, for the most part, solid. We have been using it for a few years now,

    exploitlabs.watchtowr.comMar 18, 2026, 10:02 AM
  • Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header HijackUnit42

    We analyze CVE-2025-24813 (Tomcat Partial PUT RCE), CVE-2025-27636 and CVE-2025-29891 (Camel Header Hijack RCE).

    vendorunit42.paloaltonetworks.comJul 3, 2025, 10:00 AM
  • U.S. CISA adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apache Tomcat path equivalence vulnerability, tracked as CVE-2025-24813, to its Known Exploited Vulnerabilities (KEV) catalog. The Apache Tomcat vulnerability CVE-2025-24813 was recently disclosed and is being actively exploited just 30 […]

    newssecurityaffairs.comApr 2, 2025, 1:47 PM
  • Tomcat in the Crosshairs: New Research Reveals Ongoing AttacksAqua Security Blog

    vulnerabilities are patched. Particularly internet facing applications such as Tomcat servers. Vulnerabilities such as CVE-2025-24813 that are new, critical and actively exploited should be prioritized. Disable Unused Services : Disable any services that aren’t required, particularly those that may expose the system to external attackers, such as HTTP

    vendorblog.aquasec.comApr 2, 2025, 12:00 PM
  • Security Affairs newsletter Round 516 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. U.S. Treasury removed sanctions against the crypto mixer service Tornado Cash Zero-day broker Operation Zero offers up to […]

    newssecurityaffairs.comMar 23, 2025, 6:41 PM
  • Critical or Clickbait: GitHub Actions and Apache Tomcat RCE Vulnerabilities 2025Horizon3.ai

    Explore CVE-2025-30066 and CVE-2025-24813 with real-world data from Horizon3.ai to assess whether these vulnerabilities are truly critical or overhyped.

    exploithorizon3.aiMar 21, 2025, 8:09 PM
  • GreyNoise Observes Active Exploitation of Critical Apache Tomcat RCE Vulnerability (CVE-2025-24813)GreyNoise

    Attackers are actively exploiting Apache Tomcat servers by leveraging CVE-2025-24813, a newly disclosed vulnerability that, if successfully exploited, could enable remote code execution (RCE). GreyNoise has identified multiple IPs engaging in this activity across multiple regions.

    vendorwww.greynoise.ioMar 20, 2025, 12:00 AM
  • CVE-2025-24813Horizon3.ai

    Apache Tomcat Path Equivalence Vulnerability

    exploithorizon3.aiMar 19, 2025, 7:06 PM
  • Tomcat PUT to active abuse as Apache deals with critical RCE flawCSO Online

    Apache Software’s open-source web container for handling Java-based web applications, Tomcat, is under active attacks through a critical RCE flaw the company disclosed last week. According to API security vendor, Wallarm, threat actors are using a public proof-of-concept (PoC) exploit released for the flaw, CVE-2025-24813, just 30 hours after it was publicly disclosed. “A devastating […]

    newswww.csoonline.comMar 18, 2025, 11:30 AM
  • Threat actors rapidly exploit new Apache Tomcat flaw following PoC releaseSecurity Affairs

    Threat actors began exploiting a recently disclosed Apache Tomcat vulnerability immediately after the release of a PoC exploit code. A newly disclosed Apache Tomcat vulnerability, tracked as CVE-2025-24813, is being actively exploited just 30 hours after a public PoC was released. The issue is a path equivalence flaw in Apache Tomcat that allows remote code execution […]

    newssecurityaffairs.comMar 17, 2025, 7:58 PM
  • Exploit Code for Apache Tomcat RCE Vulnerability Published on Chinese ForumSecurityWeek

    Exploits swirling for remote code execution vulnerability (CVE-2025-24813) in open-source Apache Tomcat web server.

    newswww.securityweek.comMar 17, 2025, 6:13 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence