CVE-2024-24749 is a vulnerability in GeoServer's GeoWebCache (GWC) Web Resource API when deployed on Windows with Apache Tomcat. It allows an attacker to bypass input validation and read arbitrary classpath resources, potentially leading to privilege escalation if the embedded data directory is used. This issue does not affect Linux or Mac OS deployments or those using Jetty or WildFly servers. A fix is available in GeoServer versions 2.23.5 and 2.24.3.