This vulnerability arises from a regression introduced by a prior fix (bug 60013) in Apache Tomcat where the rewritten URL was normalized before decoding. This sequence allowed attackers to craft request URIs that bypass security constraints protecting critical directories such as /WEB-INF/ and /META-INF/. The vulnerability affects multiple Apache Tomcat versions including 8.5.6 through 8.5.100, 9.0.0.M11 through 9.0.108, 10.1.0-M1 through 10.1.44, and 11.0.0-M1 through 11.0.10. If PUT requests are enabled, an attacker could upload malicious files leading to remote code execution, though this scenario is considered unlikely due to typical PUT request restrictions. The Apache Software Foundation recommends upgrading to fixed versions 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later.

Successful exploitation can lead to bypassing of security constraints that protect sensitive directories, potentially exposing application internals or configuration files. If PUT requests are enabled, attackers could upload malicious files, leading to remote code execution. The CVSS score of 7.5 (high severity) reflects the network attack vector, requirement for low privileges, and high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade Apache Tomcat to version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later to remediate this vulnerability. There is no indication that the vulnerability is mitigated by default configurations beyond this upgrade. Disabling PUT requests if not required may reduce risk but does not replace applying the official fix.