Description
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | tomcat5 | 5.0.30-12etch1 | DSA-1453-1 |
| Debian 4.0 | tomcat5.5 | 5.5.20-2etch1 | DSA-1447-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.3.0.3.el5_1 | RHSA-2008:0042 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_11rh | RHSA-2008:0195 |
| Red Hat Rhel Application Stack 1 | concurrent | 1.3.4-7jpp.ep1.6.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jaf | 1.1.0-0jpp.ep1.10.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-javamail | 1.4.0-0jpp.ep1.8 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jsf | 1.2_04-1.p02.0jpp.ep1.18 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jstl | 1.2.0-0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3 +1 | 1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.6.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hsqldb | 1:1.8.0.8-2.patch01.1jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jacorb | 2.3.0-1jpp.ep1.4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-cache | 1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-common | 1.2.1-0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-remoting | 2.2.2-3.SP4.0jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-seam +1 | 1.2.1-1.ep1.3.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossas | 4.2.0-3.GA_CP02.ep1.3.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossweb | 2.0.0-3.CP05.0jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossws-wsconsume-impl | 2.0.0-0jpp.ep1.3 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossxb | 1.0.0-2.SP1.0jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jcommon | 1.0.12-1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jfreechart | 1.0.9-1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jgroups | 1:2.4.1-1.SP4.0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | rh-eap-docs +1 | 4.2.0-3.GA_CP02.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | wsdl4j | 1.6.2-1jpp.ep1.8 | RHSA-2008:0158 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 5 | mod_perl | 2.0.2-12.el4 | RHSA-2008:0630 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-html | 5.1.1-7 | RHSA-2008:0630 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.8 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.6.el4 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-2.patch01.1jpp.ep1.1 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jacorb +3 | 2.3.0-1jpp.ep1.4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP4.0jpp.ep1.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.3.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP02.ep1.3.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-3.CP05.0jpp.ep1.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossws-jboss42 | 1.2.1-0jpp.ep1.2.el4 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.12-1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.9-1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.1-1.SP4.0jpp.ep1.2 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-3.GA_CP02.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Apache Tomcat - WebDAV SSL Remote File Disclosure EDB-4552 · remote · Oct 21, 2007 · verified
- Apache Tomcat - 'WebDAV' Remote File Disclosure EDB-4530 · remote · Oct 14, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.0.0, <= 4.0.6 | — | GHSA-v5p2-vg3c-pmrr |
| Maven | org.apache.tomcat:tomcat | 4.1.0 | — | GHSA-v5p2-vg3c-pmrr |
| Maven | org.apache.tomcat:tomcat | 5.0.0 | — | GHSA-v5p2-vg3c-pmrr |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, <= 5.5.25 | — | GHSA-v5p2-vg3c-pmrr |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, <= 6.0.14 | — | GHSA-v5p2-vg3c-pmrr |
Advisories 12
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0042 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1453-1 tomcat5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1447-1 tomcat5.5 several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0158 Red Hat Security Advisory: JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0213 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0151 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0630 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0195 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- DSA-1453 vendor-advisory
- http://tomcat.apache.org/security-4.html
- 30908 third-party-advisory
- http://support.apple.com/kb/HT2163
- [tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet mailing-list
- 26070 vdb-entry
- 27446 third-party-advisory
- 20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay mailing-list
- 30676 third-party-advisory
- RHSA-2008:0630 vendor-advisory
- 239312 vendor-advisory
- apache-tomcat-webdav-dir-traversal(37243) vdb-entry
- oval:org.mitre.oval:def:9202 vdb-entry signature
- RHSA-2008:0862 vendor-advisory
- ADV-2008-1981 vdb-entry
- 30899 third-party-advisory
- FEDORA-2007-3456 vendor-advisory
- 31493 third-party-advisory
- 29242 third-party-advisory
- ADV-2008-2823 vdb-entry
- 37460 third-party-advisory
- ADV-2008-1979 vdb-entry
- 29313 third-party-advisory
- 31681 vdb-entry
- 32120 third-party-advisory
- ADV-2007-3671 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 27398 third-party-advisory
- RHSA-2008:0042 vendor-advisory
- SUSE-SR:2008:005 vendor-advisory
- 1018864 vdb-entry
- 28361 third-party-advisory
- 28317 third-party-advisory
- APPLE-SA-2008-06-30 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2007-3674 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- 32222 third-party-advisory
- 30802 third-party-advisory
- RHSA-2008:0195 vendor-advisory
- GLSA-200804-10 vendor-advisory
- http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html
- ADV-2007-3622 vdb-entry
- http://www-1.ibm.com/support/docview.wss?uid=swg21286112
- 27727 third-party-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780 vdb-entry
- RHSA-2008:0261 vendor-advisory
- 4530 exploit
- MDVSA-2009:136 vendor-advisory
- DSA-1447 vendor-advisory
- 27481 third-party-advisory
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216