ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-55752

Relative Path Traversal vulnerability in Apache Tomcat.

Published Oct 27, 2025 · catalog updated May 12, 2026 · Apache Software Foundation Apache Tomcat

Last checked Oct 24, 2026. A connected source was read within the last 7 days.

Check this week

CVE-2025-55752 is not in CISA KEV. FIRST estimates a 64.41% chance of exploitation in the next 30 days. Check whether you run Apache Software Foundation Apache Tomcat.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
64.41%
Remediation
Vendor / distro source
Affected products
vendor Apache Software Foundation Apache Tomcat 10.1.0-M1 ≤10.1.44

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests w

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor Apache Software Foundation Apache Tomcat 10.1.0-M1 ≤10.1.4410.1.0-M1 ≤10.1.44

How to fix CVE-2025-55752

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-55752 is not in CISA KEV. FIRST estimates a 64.41% chance of exploitation in the next 30 days. Check whether you run Apache Software Foundation Apache Tomcat.

Which versions are affected?

Compare what you have installed with Apache Software Foundation Apache Tomcat 10.1.0-M1 ≤10.1.44 10.1.0-M1 ≤10.1.44. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 64.41%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2025 · EUVD

    Detected

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT

  2. May 12, 2026 · EUVD

    Updated

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT

Sources

  • CVE.orgVulnerability recordCVE-2025-55752

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-55752

    30-day exploitation probability 64.41%

    first.org
  • EUVDVulnerability recordEUVD-2025-36224

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Oct 24, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgOct 24, 2026
  • FIRST EPSSOct 24, 2026
  • EUVDOct 23, 2026