# CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet

Tomcat partial PUT wrote temp files to a path derived from the user-supplied filename, letting attackers overwrite session files and deserialize for RCE.

- Payout: $4,323
- Severity: high
- Program: Internet Bug Bounty
- Found by (vendor credit): COSCO Shipping Lines DIC, sw0rd1ight (https://github.com/sw0rd1ight)
- Found by: sw0rd1ight
- Disclosed: 2025-04-27
- CVE: CVE-2025-24813
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3031518
- Library page: https://bugbountylibrary.com/r/h1%3A3031518
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:high tech:java technique:chained vuln:deserialization vuln:path-traversal vuln:rce

**Target:** Default Servlet partial PUT handler / file-based session persistence
**Root cause:** Partial PUT built a temp file path from the user-provided file name and path with path separators replaced by '.', so a crafted name could resolve to a location outside the intended directory, allowing writes into the session storage directory.
**Steps:**
1. Enable writes on the Default Servlet (disabled by default) and rely on partial PUT (enabled by default).
2. Use Tomcat file-based session persistence with the default storage location.
3. Send a partial PUT request whose user-supplied file name/path, with separators replaced by '.', resolves into the session storage directory.
4. Write a serialized payload into a session file.
5. Trigger deserialization of the session file using a gadget library present on the classpath to execute system commands.
**Exploitation:** Attacker with write-enabled Default Servlet and partial PUT writes a malicious serialized session file into Tomcat's default file-based session storage, then triggers session deserialization to run system commands and gain system permissions.
**Escalation:** Chained the file-write primitive into deserialization of a session file to escalate from file write to remote code execution.
**Insight:** Partial PUT temp-file naming derived from user input is a write primitive; check whether the sanitized name can collide with session persistence directories, turning a file write into a deserialization sink.