CWE-44 vulnerabilities

CVE-2025-24813 is a critical vulnerability in Apache Tomcat affecting versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2. It involves path equivalence issues with internal dots in file names handled by the default servlet when write and partial PUT support are enabled. Exploitation can lead to remote code execution, information disclosure, or malicious content injection. The vulnerability requires specific conditions such as enabled writes for the default servlet, partial PUT support, and knowledge of sensitive file names. Upgrading to Apache Tomcat versions 11.0.3, 10.1.35, or 9.0.99 or later mitigates the issue.