Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Apache Tomcat 7.x Allows Remote Code Execution from Uploaded Files

CVE-2013-4444 · published 12 years ago
Summary

Apache Tomcat 7.x versions before 7.0.40 have a security issue that lets hackers upload files to the server, allowing them to potentially run malicious code. This could allow an attacker to take control of the server. Upgrade to version 7.0.40 or later to fix this issue.

What to do
  • Update apache org.apache.tomcat:tomcat to version 7.0.40.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.tomcat:tomcat >= 7.0, < 7.0.40
Fix: upgrade to 7.0.40
– apache tomcat <= 7.0.39
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
23 more version ranges
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Original advisory text
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to exec...
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
6.8 Medium
Exploitation
14% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published12 Sep 2014
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-h6c8-x5r3-pm88 · GHSA
CVE-2013-4444 · NVD
CVE-2013-4444 · MITRE
Track software like this
Free during beta