Apache Tomcat 9.0.0.M11 < 9.0.109 multiple vulnerabilities

CVE-2025-55752 is a relative path traversal in Apache Tomcat's RewriteValve caused by a regression in the fix for bug 60013. The rewritten URL is normalized *before* it is decoded, letting an attacker slip URL-encoded ../ sequences past the security filter to reach /WEB-INF/ and /META-INF/. If HTTP PUT is also enabled for untrusted users, a JSP webshell can be uploaded into those directories — full RCE. Affected versions: Tomcat 9.0.0.M11–9.0.108, 10.1.0-M1–10.1.44, 11.0.0-M1–11.0.10, and EOL 8.5.6–8.5.100. Fixed in 9.0.109, 10.1.45, and 11.0.11. The Tenable plugin also references CVE-2025-55754 (ANSI escape injection, CVSS 9.6) and CVE-2025-61795 (multipart DoS, CVSS 5.3), but the actionable risk is overwhelmingly concentrated in CVE-2025-55752.

The vendor CVSS of 7.5 HIGH is defensible *in theory* — the path-traversal-to-RCE chain is real. But it overstates the risk for the vast majority of production Tomcat deployments. RewriteValve is an optional component (Tomcat's equivalent of Apache mod_rewrite) that many shops never enable, and the DefaultServlet ships with readonly=true, meaning PUT is disabled out of the box. You need both non-default settings simultaneously for RCE. Without PUT, the impact drops to information disclosure of deployment descriptors and compiled classes — sensitive, but not fleet-ending. CVE-2025-55754's 9.6 is frankly absurd: it requires a Windows admin to be watching Tomcat logs in a raw console, then paste from a manipulated clipboard. That's social-engineering theater, not a network-exploitable vulnerability.

Why this verdict

• Dual non-default prerequisite: RCE requires RewriteValve *and* readonly=false simultaneously. Neither is a default setting. The CVSS vector already encodes AC:H for this reason, but even 7.5 overstates fleet-wide risk because most Tomcat instances satisfy zero of the two prerequisites.
• Information-disclosure-only path is the realistic ceiling: Without PUT, the attacker reads /WEB-INF/ contents. Sensitive, but bounded — especially in shops that externalize secrets to vaults or environment variables. This maps to a ~5.0–6.0 range, not 7.5.
• EPSS is high but unconfirmed: 66.5% EPSS at the 99th percentile is a strong predictive signal, but no KEV listing, no named threat actor campaigns, and no GreyNoise confirmed exploitation tags exist as of September 2026. The EPSS score is driven by PoC availability and Tomcat's popularity, not observed exploitation.
• Role multiplier: Tomcat occupies the application-tier role in most deployments — a *typical* role (category b), not inherently a high-value identity/infrastructure tier. While Tomcat *can* host identity apps or CI/CD front-ends (Jenkins), the exploit chain's success depends on Tomcat-level config (RewriteValve + PUT), not the hosted application's role. Even on a Jenkins-hosting Tomcat, the RewriteValve + PUT combo is exceedingly rare. No high-value role scenario plausibly reaches fleet/domain compromise at ≥1% of the installed base through *this specific chain*.
• No KEV, no active exploitation: Absence from KEV after nearly 12 months since disclosure is a meaningful negative signal for a vulnerability with public PoCs in a widely deployed component.

Why not higher?

Upgrading to HIGH would require either confirmed in-the-wild exploitation, KEV listing, or a single-prerequisite path to RCE. None of these conditions are met. The RCE path requires two independent non-default configurations, which compounds the friction multiplicatively — this is not a 'scan and pwn' vulnerability. The high EPSS score is noted but is a *prediction*, not evidence of exploitation.

Why not lower?

Dropping to LOW would ignore the real information-disclosure path that requires only one non-default setting (RewriteValve). RewriteValve is a legitimate, documented feature that a meaningful minority of Tomcat deployments use. Reading /WEB-INF/web.xml can expose database credentials and internal architecture. The 10+ public PoCs lower the skill barrier. MEDIUM correctly reflects a vulnerability that matters for the subset of deployments using RewriteValve but does not warrant emergency patching for the general Tomcat population.

1. Audit and disable HTTP PUT on DefaultServlet — Confirm readonly=true (the default) in web.xml for every Tomcat instance. This eliminates the RCE path entirely and takes minutes per host. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window, but this check is trivial and should be done immediately as hygiene.
2. Move URL rewriting to the reverse proxy — If you use RewriteValve, migrate rewrite rules to nginx, Apache httpd, or your load balancer. This removes the vulnerable code path from Tomcat entirely. If RewriteValve must stay, audit rules to ensure none rewrite query parameters into the URL path.
3. Block encoded path traversal at WAF/reverse proxy — Deploy WAF rules that reject requests containing %2e%2e, %252e, or other double-encoded traversal sequences in the URI. ModSecurity CRS rule 930100 and similar cover this pattern.
4. Externalize secrets from WEB-INF — Move database credentials, API keys, and LDAP bind passwords out of web.xml and property files into a secrets manager or environment variables. This limits the blast radius of the information-disclosure path.

Run this on each Tomcat host as any user with read access to the Tomcat installation directory. Example: bash check_cve_2025_55752.sh /opt/tomcat or bash check_cve_2025_55752.sh /usr/share/tomcat9. No root required.

#!/bin/bash
# check_cve_2025_55752.sh — Detect CVE-2025-55752 exposure in Apache Tomcat 9.x
# Usage: bash check_cve_2025_55752.sh <CATALINA_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"
if [ -z "$CATALINA_HOME" ]; then
  echo "UNKNOWN — provide CATALINA_HOME as argument or env var"
  exit 2
fi

# Detect version from catalina.jar manifest or version.sh
VERSION=""
if [ -f "$CATALINA_HOME/lib/catalina.jar" ]; then
  VERSION=$(unzip -p "$CATALINA_HOME/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null | grep 'Implementation-Version' | cut -d' ' -f2 | tr -d '\r')
fi
if [ -z "$VERSION" ] && [ -x "$CATALINA_HOME/bin/version.sh" ]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep 'Server number' | awk '{print $3}')
fi
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine Tomcat version in $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Check if version is in affected range for 9.x
VULNERABLE=0
if [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -lt 109 ]; then
    VULNERABLE=1
  fi
elif [ "$MAJOR" -eq 10 ] && [ "$MINOR" -eq 1 ]; then
  if [ "$PATCH" -lt 45 ]; then
    VULNERABLE=1
  fi
elif [ "$MAJOR" -eq 11 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -lt 11 ]; then
    VULNERABLE=1
  fi
fi

# Check for RewriteValve (amplifying factor)
RW_FOUND=0
for f in "$CATALINA_HOME"/conf/server.xml "$CATALINA_HOME"/conf/context.xml $(find "$CATALINA_HOME/conf" -name '*.xml' 2>/dev/null); do
  if [ -f "$f" ] && grep -qi 'RewriteValve' "$f" 2>/dev/null; then
    RW_FOUND=1
    echo "WARNING: RewriteValve found in $f"
    break
  fi
done

# Check for PUT enabled (RCE amplifier)
PUT_ENABLED=0
for f in $(find "$CATALINA_HOME" -name 'web.xml' 2>/dev/null); do
  if grep -qi 'readonly.*false' "$f" 2>/dev/null; then
    PUT_ENABLED=1
    echo "WARNING: PUT enabled (readonly=false) in $f"
    break
  fi
done

if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — Tomcat $VERSION is affected by CVE-2025-55752"
  [ "$RW_FOUND" -eq 1 ] && echo "  -> RewriteValve active: path traversal is exploitable"
  [ "$PUT_ENABLED" -eq 1 ] && echo "  -> PUT enabled: RCE path is open"
  [ "$RW_FOUND" -eq 0 ] && echo "  -> RewriteValve not found: exploitation requires it (lower risk)"
  exit 1
else
  echo "PATCHED — Tomcat $VERSION is not affected by CVE-2025-55752"
  exit 0
fi

Sources

1. Tenable Plugin 271691
2. Apache Tomcat 9.x Security Advisories
3. NVD — CVE-2025-55752
4. CyCognito Emerging Threat Analysis
5. SOC Prime — CVE-2025-55752 and CVE-2025-55754
6. TAM-K592 PoC Exploit
7. HeroDevs — RewriteValve Path Traversal Analysis
8. Red Hat CVE Page