CVE-2025-24813: Apache Tomcat RCE via Partial PUT
Can Apache Tomcat be exploited for RCE?
A path equivalence vulnerability in Apache Tomcat that, combined with partial PUT request handling and default servlet configuration, allows unauthenticated remote code execution via deserialization of uploaded session files.
Impact & Exploitation
Active exploitation 30 hours after PoC release. Tomcat powers millions of Java web applications. Affects deployments with default servlet write-enabled and file-based session persistence.
Precogs Research
This vulnerability intelligence report was analyzed and enriched by the Precogs AI Security Team. Our researchers continuously monitor emerging threats across AI code, LLM pipelines, and binary architectures to ensure accurate real-time remediation guidance.