Security Research

CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging

Tomcat’s default servlet serves as a “static file server” with both read and write capability exposed — the attacker uses a Content-Range partial PUT to write a JSP payload into Tomcat’s work directory, then a GET request makes default servlet compile and execute it as JSP. The whole RCE chain completes on the public internet.

Unlock to view this content.