CVE-2025-55752

CVE-2025-55752 is a relative path traversal (CWE-23) in Apache Tomcat caused by a regression in the fix for bug 60013, in which rewritten URLs were normalized before they were decoded. The flaw is triggered when rewrite rules rewrite query parameters into the URL, allowing an attacker to manipulate the request URI in a way that defeats URL normalization. As a result, an attacker can bypass security constraints, including the built-in protections for the /WEB-INF/ and /META-INF/ paths, and if PUT requests are also enabled, uploaded malicious files can lead to remote code execution (the vendor notes PUT is normally restricted to trusted users, making the RCE path unlikely in practice). Affected deployments are Tomcat 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, and the EOL 8.5.6 through 8.5.100 (older EOL versions may also be affected). The issue is not yet in CISA KEV, but a public PoC/detection writeup exists and EPSS assigns a ~67% probability of exploitation within 30 days, so patching is urgent.

What to do: Upgrade to Tomcat 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later; 8.5 users should move to a supported version line since 8.5 is EOL. Review rewrite configurations for rules that rewrite query parameters to the URL, and confirm PUT is disabled or limited to trusted users. Until patched, verify that /WEB-INF/ and /META-INF/ protections remain effective and monitor for exploitation given the elevated EPSS score.