CVE-2025-24813

CVE-2025-24813 - Apache Tomcat 경로 동등성 취약점 Apache Tomcat은 경로에서 ../ 시퀀스를 부적절하게 처리하여 Path Equivalence / Path Traversal 문제에 취약합니다. CVE ID: CVE-2025-24813 심각도: Critical 참고 링크: https://github.com/advisories/GHSA-83qj-6fr2-vhqg PoC 단계: 1.curl 요청을 PUT 메서드로 보냅니다: curl -X PUT...

CVE-Arsenal-Lab

TomcatScanner CVE-2025-24813용 고급 탐지 및 익스플로잇 도구 TomcatScanner는 Apache Tomcat 서버에서 CVE-2025-24813 취약점을 탐지하고 익스플로잇하기 위해 설계된 종합 보안 도구입니다. 이 취약점은 'file.Name' 매개변수의 경로 동등성path equivalence 문제로 인해 원격 코드 실행RCE으로 이어질 수 있습니다. 목차 기능 설치 사용법 기본 스캔 고급 옵션 익스플로잇 모드 예제 워드리스트 만들기 출력 해석 CVE-2025-24813 설명 법적 고지 기여 라이...

CVE-2025-24813-POC

JSP 웹 셸 업로더 HTTP PUT 요청을 통해 하나 이상의 대상에 기본 JSP 웹 셸을 업로드하는 간단한 Python 도구입니다. ⚠️ 교육 및 승인된 침투 테스트 전용입니다. Apache Tomcat은 경로에서 ../ 시퀀스를 부적절하게 처리하여 경로 동등성Path Equivalence / 경로 탐색Path Traversal 문제에 취약합니다. CVE ID: CVE-2025-24813 심각도: Critical 참조 링크: https://github.com/advisories/GHSA-83qj-6fr2-vhqg 🧰 기능 명령...

httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

nuclei-CVE-2025-24813

nuclei-CVE-2025-24813 이 저장소는 취약점 스캐너 nuclei를 사용하여 서비스가 CVE-2025-24813에 취약할 가능성이 있는지 서버를 방해하거나 어떠한 형태의 손상도 일으키지 않고 스캔하기 위한 yaml-template을 포함하고 있습니다. CVE-2025-24813 CVE-2025-24813은 Apache Tomcat 웹서버 버전 9.0.0-9.0.98, 10.1.0-10.1.34 및 11.0.0-11.0.2에 존재하는 취약점입니다. 이는 서버가 partial PUT을 통한 쓰기 접근을 허용하도록 구성...

CVE-2026-79768

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-79768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directiv...

DEBIAN-CVE-2026-79768

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

CVE-2026-79768

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

CVE-2026-79768 Apache HTTP Server: mod_userdir information disclosure

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

CVE-2026-79768

The Apache HTTP Server versions 2.4.0 through 2.4.68 are vulnerable to a path equivalence issue (CWE-55) within the mod_userdir module. The vulnerability occurs when the module is configured with an absolute non-wildcard UserDir directive . This flaw can lead to information disclosure . No specif...

CVE-2026-79768

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

EUVD-2026-90909

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

CVE-2026-79768

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1742733084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1742733084 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...

Apache HTTPD: CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

PT-2026-103942

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's mod userdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod userdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 throug...

CentOS Linux 7 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (CENTOS7:CLSA-2025:1755272015)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1755272015 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...

CentOS Linux 6 [TuxCare] Security Update: tomcat6 / tomcat6-admin-webapps / tomcat6-docs-webapp / etc (CENTOS6:CLSA-2025:1755513827)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1755513827 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...

CVE-2026-66835

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...