Apache Tomcat Flaws Allow Remote Code Execution on Vulnerable Servers

According to The Apache Software Foundation, two security vulnerabilities affect multiple Apache Tomcat versions, with one flaw posing a serious risk of remote code execution on vulnerable servers. The issues are CVE-2025-55752, a directory traversal via rewrite with possible RCE if PUT is enabled, and CVE-2025-55754, which involves console manipulation through escape sequences in log messages.

The vulnerabilities impact Tomcat 9, 10, and 11 series, including 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, and 9.0.0.M11 through 9.0.108, and were discovered by security researcher Chumy Tsai from CyCraft Technology and identified by Elysee Franchuk of MOBIA Technology Innovations. Apache has released patched versions, with upgrades to 11.0.11, 10.1.45, or 9.0.109 depending on deployment, and the security advisories note that the updates were announced on 27 October 2025. While PUT restrictions are typically limited to trusted users, the directory traversal flaw could enable malicious file uploads that lead to RCE.