The vulnerability of the pathInfo URI component of the Apache Tomcat application server allows attackers to circumvent existing security restrictions.

🗓️ 08 Aug 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

PathInfo vulnerability in Apache Tomcat allows remote bypass of security restrictions due to improper registrations handling.

Reporter	Title	Published	Views	Family All 162
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	30 Oct 202520:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Handling of Case Sensitivity in Apache Tomcat [CVE-2025-46701]	28 Aug 202517:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Sep 202511:51	–	ibm
IBM Security Bulletins	Security Bulletin: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint, which affects IBM watsonx.data	1 Sep 202514:50	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tomcat, IBM ApplinX is vulnerable to multiple vulnerabilities.	15 Jul 202509:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.	20 Nov 202506:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Catridge affected by vulnerability in tomcat-embed-core-10.1.35.jar	26 Aug 202517:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is affected by multiple vulnerabilities	12 Nov 202514:34	–	ibm
GithubExploit	Exploit for Improper Handling of Case Sensitivity in Apache Tomcat	29 Apr 202500:47	–	githubexploit
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1030)	23 Jun 202500:00	–	nessus

Vulners

Node

red_hat jboss_web_serverMatch5

red_hat jboss_web_serverMatch6

apache tomcatRange11.0.0-m1–11.0.7

apache tomcatRange10.1.0-m1–10.1.41

apache tomcatRange9.0.0.m1–9.0.105

axiom_jdk libercat_certifiedRange<9.0.107-1

axiom_jdk libercat_certifiedRange<10.1.43-1

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

canonical ubuntuMatch25.04

red_hat red_hat_enterprise_linuxMatch10

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/05/29/4
lists	www.lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j
access	www.access.redhat.com/security/cve/cve-2025-46701
ubuntu	www.ubuntu.com/security/CVE-2025-46701
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.14/
web	www.web.nvd.nist.gov/view/vuln/detail

20 Apr 2026 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 37.3

CVSS 27.5

EPSS0.02608