Apache Tomcat Patches URL Rewrite Bypass (CVE-2025-55752) Risking RCE and Console ANSI Injection

On 28 October 2025, Apache Tomcat patches were issued for three newly disclosed vulnerabilities, CVE-2025-55752, CVE-2025-55754 and CVE-2025-61795, affecting Tomcat 9, 10 and 11 across several release lines. The most severe, CVE-2025-55752, could potentially lead to remote code execution if certain conditions are met, arising from a regression in URL rewrite handling, and according to the advisory, it could allow bypassing access controls and, in some configurations, uploading malicious files via HTTP PUT requests.

Apache notes that exploitation is unlikely in standard configurations since PUT requests are normally limited to trusted users and would not typically be enabled alongside a rewrite that manipulated the URI. Affected versions include Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, with upgrades advised to 11.0.11, 10.1.45 or 9.0.109.

CVE-2025-55754 relates to Windows consoles supporting ANSI escape sequences and could enable manipulation of the console and clipboard via specially crafted URLs, while CVE-2025-61795 could cause a DoS during multipart file uploads, with upgrades recommended to 11.0.12, 10.1.47 or 9.0.110.