The default value of the readonly param is true, according to Tomcat's docs, and the CVE itself. — if I don't have `readonly` in my web.xml? Tension: That means that writes are not enabled, if the readonly param is missing from the servlet configuration. Outcome: writes are not enabled, if the readonly param is missing from the servlet configuration.

57cfca55-5594-4ce7-95af-991c6d8cb33b