{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2025-55752/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2025-55752"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tomcat (11.0.0-M1 to 11.0.10)","Tomcat (10.1.0-M1 to 10.1.44)","Tomcat (9.0.0-M11 to 9.0.108)","Tomcat (8.5.6 to 8.5.100)"],"_cs_severities":["high"],"_cs_tags":["apache-tomcat","path-traversal","cve-2025-55752","webserver"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eCVE-2025-55752 is a high-severity path traversal vulnerability affecting Apache Tomcat's RewriteValve. The flaw stems from an incorrect processing order where URL normalization occurs prior to URL decoding. Attackers can exploit this by crafting requests containing URL-encoded path traversal sequences, such as '..%2f', which bypass filters that would normally block access to restricted directories like '/WEB-INF/'.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized disclosure of sensitive server files, including application configuration files such as 'web.xml'. The CVSS v3.1 score is 7.5, reflecting a significant risk to confidentiality and integrity in affected environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Tomcat to the patched versions: 11.0.11+, 10.1.45+, or 9.0.109+. Note that 8.5.x is EOL and will not receive a patch.\u003c/li\u003e\n\u003cli\u003eDisable the 'RewriteValve' if it is not strictly required by the application.\u003c/li\u003e\n\u003cli\u003eDisable the PUT method if not needed, as a precautionary measure.\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to inspect HTTP request URIs for path traversal patterns, specifically targeting sequences like '../' and their URL-encoded variants (e.g., '%2e%2e%2f', '..%2f').\u003c/li\u003e\n\u003cli\u003eAudit existing logs for attempted access to '/WEB-INF/' or '/META-INF/' patterns using encoded sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T22:23:16Z","date_published":"2026-10-29T22:23:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-path-traversal/","summary":"A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.","title":"Apache Tomcat: Path traversal via RewriteValve (CVE-2025-55752)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2025-55752","version":"https://jsonfeed.org/version/1.1"}