Skip to content
Threat Feed
Subscribe
high advisory

Apache Tomcat: Path traversal via RewriteValve (CVE-2025-55752)

A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.

CVE search metadata

CVE search record: CVE-2025-55752. Severity: high. CVSS: 7.5. EPSS: 64.41%. KEV: no. Product: Tomcat (11.0.0-M1 to 11.0.10), Tomcat (10.1.0-M1 to 10.1.44), Tomcat (9.0.0-M11 to 9.0.108), Tomcat (8.5.6 to 8.5.100). Brief: Apache Tomcat: Path traversal via RewriteValve (CVE-2025-55752). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-path-traversal/

Triage facts

Revision 1
Applicability
Tomcat (11.0.0-M1 to 11.0.10), Tomcat (10.1.0-M1 to 10.1.44) +2
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 29, 22:23 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CVE-2025-55752 is a high-severity path traversal vulnerability affecting Apache Tomcat's RewriteValve. The flaw stems from an incorrect processing order where URL normalization occurs prior to URL decoding. Attackers can exploit this by crafting requests containing URL-encoded path traversal sequences, such as '..%2f', which bypass filters that would normally block access to restricted directories like '/WEB-INF/'.

Impact

Successful exploitation allows unauthorized disclosure of sensitive server files, including application configuration files such as 'web.xml'. The CVSS v3.1 score is 7.5, reflecting a significant risk to confidentiality and integrity in affected environments.

Recommendation

  • Upgrade Apache Tomcat to the patched versions: 11.0.11+, 10.1.45+, or 9.0.109+. Note that 8.5.x is EOL and will not receive a patch.
  • Disable the 'RewriteValve' if it is not strictly required by the application.
  • Disable the PUT method if not needed, as a precautionary measure.
  • Deploy WAF rules to inspect HTTP request URIs for path traversal patterns, specifically targeting sequences like '../' and their URL-encoded variants (e.g., '%2e%2e%2f', '..%2f').
  • Audit existing logs for attempted access to '/WEB-INF/' or '/META-INF/' patterns using encoded sequences.

Immediate actions

Patch Apache Tomcat to versions 11.0.11+, 10.1.45+, or 9.0.109+

IT Operations 48h

Deploy WAF signatures to block URI patterns containing URL-encoded traversal sequences

SOC 24h

Threat Hunt

Search web server logs for suspicious /WEB-INF/ or /META-INF/ access requests containing encoded sequences

T1190 high high confidence hunt now

Data: webserver access logs

Mitigations

Disable RewriteValve or the PUT method on internet-facing Tomcat servers if they are not required

immediate IT Operations

CVE-2025-55752

Detection coverage 1

Detect CVE-2025-55752 Exploitation Attempt - Path Traversal in RewriteValve

high

Detects HTTP requests containing URL-encoded path traversal sequences directed at sensitive application directories

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →