try to address the issue with CVE-2025-24813 spotted via https://nvd.…

[aeggerd]

Hi Philip,
our IT security department found the following vulnerability in the latest version.
https://nvd.nist.gov/vuln/detail/CVE-2025-24813

i tried to address it using the following guide:
https://dev.to/carrie_luo1/apache-tomcat-partial-put-remote-code-execution-vulnerability-cve-2025-24813-1pae

Could you might review the changes that i made to the web.xml files.
Get back to me if you have any more questions regarding this.
Best Michael

[phax]

Hello @aeggerd thanks for providing the PR.
However, your solution limits the SMP to the Tomcat application server by introducing a specific dependency.
I already tackled that CVE in #319 by updating and re-creating the Docker images which lead to an updated image with an up-to-date Tomcat version.

Additionally, the path / is already mapped to class SMPRootServlet so the Tomcat default servlet will not kick in.

The update of Tomcat itself is something that each SMP users needs to do on its own.

If you agree, I would not merge your PR based on the arguments mentioned above.

hth, Philip

[aeggerd]

Awesome that will definitely work as well :)