This vulnerability (CVE-2025-55752) in Apache Tomcat arises from a regression introduced by the fix for bug 60013, where the rewritten URL was normalized before decoding. This flaw allows attackers to manipulate the request URI in rewrite rules that affect query parameters, enabling bypass of security constraints protecting critical directories like /WEB-INF/ and /META-INF/. When the HTTP PUT method is enabled, which is typically restricted to trusted users, attackers could upload malicious files leading to remote code execution. The affected versions include Apache Tomcat 8.5.6 through 8.5.100, 9.0.0 through 9.0.108, 10.1.0 through 10.1.44, and 11.0.0 through 11.0.10. The issue has been fixed in versions 8.5.101 and later, 9.0.109 and later, 10.1.45 and later, and 11.0.11 and later.

Attackers can bypass security constraints on sensitive directories, potentially accessing or modifying protected resources. If the HTTP PUT method is enabled, this vulnerability can be exploited to upload malicious files, resulting in remote code execution. However, enabling PUT requests is uncommon and typically restricted, reducing the likelihood of exploitation in many environments.

A fix is available. Users should upgrade to Apache Tomcat versions 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later to remediate this vulnerability. If upgrading is not immediately possible, ensure that the HTTP PUT method is disabled unless explicitly required and restricted to trusted users. Review rewrite rules to avoid manipulation of query parameters that could lead to URI bypass.