CVE-2025-55754

An attacker sends a specially crafted URL containing ANSI control sequences, which Tomcat writes to logs without proper neutralization. If Tomcat runs in a Windows system console that supports ANSI sequences (e.g., Windows Terminal), these sequences are interpreted by the terminal, allowing manipulation of console content and system clipboard. As a result, an attacker can display false messages or modify clipboard contents to trick the administrator into executing a malicious command. A similar attack may have been possible on other operating systems, although no specific attack vector was identified.

An attacker can manipulate the administrator console interface and the contents of the system clipboard to trick the administrator into executing an attacker-controlled command, which may lead to system compromise.

Apache Tomcat should be updated to version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later. Versions from the 8.5.x branch are marked as EOL and will not receive a patch — migration to a supported branch is recommended.

Apache Tomcat in versions: 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, 9.0.40 to 9.0.108. EOL versions 8.5.60–8.5.100 are also vulnerable. Older EOL versions may also be affected.