Apache Tomcat: Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled (CVE-2025-55752)

The fix for bug 60013 introduced a regression where the
rewritten URL was normalized before it was decoded. This introduced the
possibility that, for rewrite rules that rewrite query parameters to the
URL, an attacker could manipulate the request URI to bypass security
constraints including the protection for /WEB-INF/ and
/META-INF/. If PUT requests were also enabled then malicious
files could be uploaded leading to remote code execution. PUT requests
are normally limited to trusted users and it is considered unlikely that
PUT requests would be enabled in conjunction with a rewrite that
manipulated the URI.