CVE-2025-55752 Siemens CVE debrief

Who should care

Administrators and security teams running affected Apache Tomcat versions, especially deployments that use rewrite rules which map query parameters into the URL and any environment where PUT requests are enabled. Also review products or appliances that embed Tomcat, including the Siemens advisory context in the supplied source corpus, and treat EOL Tomcat versions as potentially affected until verified.

Technical summary

The regression introduced by the fix for bug 60013 changed request processing so the rewritten URL was normalized before decoding. For rewrite rules that move query parameters into the URL, this could let an attacker influence path handling enough to bypass protected areas like /WEB-INF/ and /META-INF/. The issue affects Tomcat 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, and 9.0.0.M11 through 9.0.108; EOL versions 8.5.6 through 8.5.100 were also noted as affected. The CVE notes that PUT must also be enabled for the path to file-upload-to-RCE impact, which makes exploitation less likely but still serious in the right configuration.

Defensive priority

High, with configuration-dependent exposure.

Recommended defensive actions

• Upgrade Apache Tomcat to 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later.
• Review rewrite rules for any logic that copies query parameters into the URL and remove or constrain that behavior where possible.
• Disable or tightly restrict HTTP PUT unless it is explicitly required and authenticated.
• Audit access controls protecting /WEB-INF/ and /META-INF/ and verify they are not bypassable in your current configuration.
• Inventory embedded or bundled Tomcat instances, including EOL branches, and confirm whether they inherit the vulnerable rewrite behavior.
• If you are following the Siemens advisory context in the supplied source corpus, apply the vendor remediation guidance to SIMATIC CN 4100 versions at V5.0 or later per the referenced advisory.

Evidence notes

Supplied timeline shows CVE published 2026-05-12 and modified 2026-05-14; those dates are used here for disclosure timing. The source corpus is internally mixed: the CISA CSAF container and Siemens references present an OT advisory wrapper, while the vulnerability description itself is Apache Tomcat CVE-2025-55752. The advisory states affected Tomcat ranges of 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, and EOL 8.5.6 through 8.5.100; exploit impact depends on rewrite-rule behavior and enabled PUT. No KEV entry was supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.