Description
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_2.1 | RHSA-2008:0648 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_12rh | RHSA-2008:0864 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_12rh | RHSA-2008:1007 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-5.CP07.0jpp.ep1.1.el4 | RHSA-2008:0877 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Tomcat UTF-8 Directory Traversal Vulnerability
auxiliary/admin/http/tomcat_utf8_traversal
-
TrendMicro Data Loss Prevention 5.5 Directory Traversal
auxiliary/admin/http/trendmicro_dlp_traversal
Exploit-DB 2
- Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal EDB-14489 · remote · Jul 28, 2010 · verified
- Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC) EDB-6229 · remote · Aug 11, 2008 · verified
GitHub 1 repository
-
Naramsim/Offensive ★ 1 · Oct 13, 2016
Reproducible exploits for: CVE-2016-1240 CVE-2008-2938 CVE-2014-2064 CVE-2014-1904
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.39 | 4.1.39 | GHSA-m7xj-ccqc-p4g2 |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.27 | 5.5.27 | GHSA-m7xj-ccqc-p4g2 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.18 | 6.0.18 | GHSA-m7xj-ccqc-p4g2 |
Advisories 5
- RHSA-2008:0648 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:1007 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0864 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0877 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- 37297 third-party-advisory
- RHSA-2008:0862 vendor-advisory
- ADV-2008-2823 vdb-entry
- 31982 third-party-advisory
- 31681 vdb-entry
- 32120 third-party-advisory
- VU#343355 third-party-advisory
- tomcat-allowlinking-utf8-directory-traversal(44411) vdb-entry
- 31865 third-party-advisory
- FEDORA-2008-8130 vendor-advisory
- 31639 third-party-advisory
- SUSE-SR:2008:018 vendor-advisory
- oval:org.mitre.oval:def:10587 vdb-entry signature
- 1020665 vdb-entry
- MDVSA-2008:188 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320 vdb-entry
- RHSA-2008:0864 vendor-advisory
- ADV-2008-2343 vdb-entry
- SUSE-SR:2009:004 vendor-advisory
- 6229 exploit
- http://tomcat.apache.org/security-6.html
- 30633 vdb-entry
- 20091107 ToutVirtual VirtualIQ Multiple Vulnerabilities mailing-list
- 32222 third-party-advisory
- 31891 third-party-advisory
- 33797 third-party-advisory
- 4148 third-party-advisory
- FEDORA-2008-7977 vendor-advisory
- 20080811 Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability mailing-list
- FEDORA-2008-8113 vendor-advisory
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780 vdb-entry
- HPSBUX02401 vendor-advisory
- http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 32266 third-party-advisory
- RHSA-2008:0648 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list