Apache Tomcat RCE (CVE-2025-24813): PUT, session persistence, and remote code execution

What happened

On 10 March 2025, Apache disclosed CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat. The vendor advisory (Apache Tomcat security) describes a path where a PUT request can write a file inside the web application, and session persistence can later deserialize or execute it.

The sequence matters: partial PUT support plus case-insensitive file handling on some setups allowed an attacker-controlled file to land where Tomcat treats it as executable content. When session persistence is enabled, a crafted session file completes the chain to RCE.

Affected lines include Tomcat 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0-M1 through 9.0.98 when writes are enabled for the default servlet and the other preconditions hold.

Impact

A successful exploit gives the attacker the ability to run code as the Tomcat process user. In practice that means reading application config, stealing secrets from environment files, pivoting inside the VPC, and planting persistence.

CISA added the issue to the Known Exploited Vulnerabilities catalog within days, and public proof-of-concept code circulated quickly. Any internet-facing Tomcat with PUT writes enabled should be treated as potentially compromised until proven otherwise.

Root cause in one paragraph

The default servlet trusted the request path for write placement while the platform treated filenames case-insensitively in some deployments; a file that looked like static content at write time became executable content at serve time, and the session persistence mechanism provided the deserialization trigger that turned a file write into code execution.

What to do now

• Upgrade to Tomcat 11.0.3+, 10.1.35+, or 9.0.99+ (whatever line you run).
• Disable writes for the default servlet (readonly=true, the default) unless you have a proven need for PUT.
• Disable session persistence (StandardManager pathname="") if you do not rely on it.
• Block PUT and DELETE at the reverse proxy for paths that should be read-only.
• Rotate secrets on any host that was exposed with writes enabled, then look for unknown JSP files, unexpected session files, and child processes of the Tomcat user.

What this means for Magento stores

Most Magento deployments do not run Tomcat in production, but many run it indirectly: Solr or OpenSearch dashboards, Java-based ETL workers, or a legacy admin tool behind the same VPC. The lesson transfers directly to PHP: file-upload placement plus a deserializer is the classic Magento RCE shape too (think permissive media upload plus unserialize in a queue worker). Audit where uploaded bytes land and what later reads them.

Sources

• NVD: CVE-2025-24813
• Apache Tomcat security pages for versions 9, 10.1, and 11
• CISA KEV catalog entry for CVE-2025-24813

Next in this series: Next.js middleware bypass (CVE-2025-29927) — /blog/cve-2025-nextjs-middleware-29927