A path equivalence bug in Tomcat’s Default Servlet.
If writes are enabled and partial PUT is allowed, an attacker can abuse filenames like file.Name to plant content where they shouldn’t and in the right setup, that leads to remote code execution.
RCE needs a few things lined up:
• Default Servlet writable (readonly=false)
• Partial PUT enabled
• File-based session persistence
• A deserialization gadget on the classpath
Default installs are usually fine. Misconfigured ones are not.
✅ Fix: upgrade to Tomcat 11.0.3 / 10.1.35 / 9.0.99, keep the Default Servlet read-only, and avoid file-based session stores unless you need them.
❓ Want to practice it hands-on?
Solve Bucket on MahadSec:
🛡 https://my.mahadsec.com/standalone-labs/machine/bucket