Cve-2025-55752 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2025-55752/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 22:23:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Tomcat: Path traversal via RewriteValve (CVE-2025-55752)https://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-path-traversal/Thu, 29 Oct 2026 22:23:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-tomcat-path-traversal/A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.CVE-2025-55752 is a high-severity path traversal vulnerability affecting Apache Tomcat's RewriteValve. The flaw stems from an incorrect processing order where URL normalization occurs prior to URL decoding. Attackers can exploit this by crafting requests containing URL-encoded path traversal sequences, such as '..%2f', which bypass filters that would normally block access to restricted directories like '/WEB-INF/'.

Impact

Successful exploitation allows unauthorized disclosure of sensitive server files, including application configuration files such as 'web.xml'. The CVSS v3.1 score is 7.5, reflecting a significant risk to confidentiality and integrity in affected environments.

Recommendation

  • Upgrade Apache Tomcat to the patched versions: 11.0.11+, 10.1.45+, or 9.0.109+. Note that 8.5.x is EOL and will not receive a patch.
  • Disable the 'RewriteValve' if it is not strictly required by the application.
  • Disable the PUT method if not needed, as a precautionary measure.
  • Deploy WAF rules to inspect HTTP request URIs for path traversal patterns, specifically targeting sequences like '../' and their URL-encoded variants (e.g., '%2e%2e%2f', '..%2f').
  • Audit existing logs for attempted access to '/WEB-INF/' or '/META-INF/' patterns using encoded sequences.
]]>highadvisoryapache-tomcatpath-traversalcve-2025-55752webserver