Notifications
Clear all
Topic starter
20/08/2026 5:49 pm
TL;DR: CVE-2025-55752 is a path traversal flaw in Apache Tomcat that can bypass access controls and, where HTTP PUT is enabled, support file upload and possible remote code execution, according to CYCOGNITO. Exposed legacy Tomcat instances, rewrite rules, and unmonitored internet-facing deployments turn a configuration-dependent issue into a practical attack path.
NHIMG editorial — based on content published by CYCOGNITO: Sample of assets impacted by CVE-2025-55752, identified by CyCognito Platform
By the numbers:
- Tomcat 11.0.0-M1 through 11.0.10, Tomcat 10.1.0-M1 through 10.1.44, and Tomcat 9.0.0-M11 through 9.0.108 are affected by CVE-2025-55752.
- Apache patched the issue in Tomcat 11.0.11, 10.1.45, and 9.0.109.
Questions worth separating out
Q: What breaks when Tomcat path traversal is not controlled?
A: When Tomcat normalisation and decoding do not align with access controls, attackers may reach restricted directories that should never be exposed.
Q: Why do exposed application servers increase application attack risk?
A: Exposed application servers sit at a boundary where routing, authorization, and backend trust intersect.
Q: How can security teams know whether Tomcat authentication exposure is actually contained?
A: They should confirm every JNDIRealm deployment, verify whether GSSAPI binds are enabled, and check whether the vulnerable versions are still running in production, staging, or third-party hosted platforms.
Practitioner guidance
- Audit external Tomcat exposure Map every Apache Tomcat instance, then verify which ones are internet-facing, reachable from untrusted networks, or hidden in legacy environments.
- Disable unnecessary HTTP PUT Remove PUT support wherever the application does not explicitly require it, and confirm that upload paths cannot be used to place executable content in writable directories.
- Validate rewrite and decoding behaviour Test how proxies, rewrite rules, and Tomcat itself interpret crafted paths, especially where access checks depend on URL normalisation.
What's in the full analysis
CYCOGNITO's full article covers the operational detail this post intentionally leaves for the source:
- Version-by-version impact analysis for affected Tomcat builds and why some EOL deployments may still be at risk
- Configuration conditions that increase exploitability, including rewrite rules and HTTP PUT exposure
- Short-term mitigation steps versus durable remediation, including how to validate patches after deployment
- Guidance on monitoring for suspicious upload behaviour and traversal attempts across exposed web services
👉 Read CYCOGNITO's analysis of CVE-2025-55752 and exposed Tomcat workloads →
Tomcat path traversal risk: what practitioners need to act on?
Explore further
20/08/2026 6:29 pm
Configuration-dependent exploitation is the real control gap here. CVE-2025-55752 is not just a patching story, because the same flaw becomes materially more dangerous only when rewrite rules, HTTP PUT, and internet exposure line up. That is a governance problem as much as a vulnerability problem. Security teams should treat exploitability as a function of configuration state, not version number alone.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a vulnerable Tomcat server remains exposed?
A: Accountability usually spans the application owner, platform team, and whoever owns external attack surface governance. If a third party manages the server, the organisation still needs assurance that patching, configuration validation, and exposure review are being performed. NIST SP 800-53 and NIST CSF both reinforce that control ownership cannot be ambiguous.
👉 Read our full editorial: CVE-2025-55752 exposes Tomcat path traversal and upload risk
