
This repository contains a shell script based POC on Apache Tomcat CVE-2025-24813. It allow you to easily test the vulnerability on any version of Apache Tomcat
This POC allow you to test any tomcat version to verify whether that version is vulnerable to CVE-2025-24813 under the vulnerable conditions, in Unix environments (tested on a Ubuntu machine).
Note: tested using openjdk 11.
tomcat_version variable in 01-prepare-environment.sh file to the targeted tomcat version
#!/bin/bash
tomcat_version="10.1.20"
01-prepare-environment.sh02-test.shPlease read https://digitaldefenders.substack.com/p/cve-2025-24813-one-guard-lies-one for a more detailed explanation on this vulnerability.