https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:39:06 +0000 https://cve.radiocsirt.org/vuln/cve-2025-24813 <p><strong>Affected:</strong> Apache Software Foundation Apache Tomcat</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Tomcat</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-24813