Apache Tomcat CVE-2025-55752

Upgrade Apache Tomcat to version 11.0.11 or later for 11.x branch, version 10.1.45 or later for 10.x branch, or version 9.0.109 or later for 9.x branch as recommended by Apache Security Team (advisory: https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog). Organizations running EOL 8.5.x versions should migrate to a supported branch, as no patch will be issued for EOL releases. For environments unable to upgrade immediately, implement defense-in-depth controls: disable HTTP PUT method at the connector level unless explicitly required for trusted administrative interfaces (set readonly='true' in DefaultServlet configuration or use security-constraint elements to block PUT in web.xml), restrict RewriteValve usage to avoid rules that transform query parameters into path components, and implement web application firewall rules to detect and block path traversal sequences (../, encoded variants) in URLs targeting protected directories. Note that disabling PUT eliminates the RCE vector but does not address the underlying constraint bypass issue, which may still expose sensitive files in /WEB-INF/ and /META-INF/ directories to unauthorized read access. Vicarius provides detection and mitigation guidance at https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerability and https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerability. Organizations using Siemens products should consult SSA-032379 for product-specific remediation timelines.