CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-24813Public Exploit

Apache Tomcat - RCE (CVE-2025-24813)

PublishedMar 10, 2025
First SeenMar 19, 2025
Last Seen
Reported
CVSS9.8
Apache
ApacheTomcat
web_server

Description

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled.

psychologyCrowdSec Analysis

CVE-2025-24813 is a critical vulnerability involving path equivalence that can allow remote code execution, information disclosure, or the addition of malicious content through improperly handled writable file paths.

CrowdSec has been tracking this vulnerability and its exploits since 17th of March 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-24813 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Detected exploitation attempts are characterized by requests to URLs such as /check.txt or paths under /uploads/../sessions/ ending in .session.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-03-10
Rule Released2025-03-17
CrowdSec First Seen2025-03-19
CISA KEV2025-04-01
CISA Remediation Deadline2025-04-22

Related Weaknesses

CWE-44: Path Equivalence: 'file.name' (Internal Dot)

The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

arrow_forward
CWE-502: Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References