Description
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.9.el5_5 | RHSA-2010:0580 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.17 | RHSA-2010:0582 |
| Red Hat JBoss Web Server 1 | glassfish-jsf | 1.2_13-2.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | httpd +2 | 2.2.14-1.2.1.ep5.el5 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | httpd22 +6 | 2.2.14-4.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-commons-chain | 1.2-2.1.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-commons-digester | 1.8.1-7.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-commons-io | 1.4-1.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-commons-modeler | 2.0-3.3.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-commons-validator | 1.3.1-7.4.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jakarta-oro | 2.0.8-3jpp.ep1.3.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | jboss-javaee +2 | 5.0.1-2.3.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | mod_jk +2 | 1.2.28-4.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | mod_ssl | 1:2.2.14-1.2.1.ep5.el5 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | mod_ssl22 | 1:2.2.14-4.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | struts12 | 1.2.9-2.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | tomcat-native | 1.1.19-2.0.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.28-7.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.24-2.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | xerces-j2 | 2.9.1-2.2_patch_01.ep5.el4 | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1 | xml-commons-resolver12 | 1:1.2-1.1.ep5.el4 | RHSA-2010:0119 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.19 | RHSA-2010:0693 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.29 | 5.5.29 | GHSA-8wch-9gcg-v2pr |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.24 | 6.0.24 | GHSA-8wch-9gcg-v2pr |
Advisories 5
- RHSA-2010:0693 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0582 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0580 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0119 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.1 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1023504 vdb-entry
- HPSBUX02541 vendor-advisory
- HPSBMA02535 vendor-advisory
- http://svn.apache.org/viewvc?rev=892815&view=rev
- 39317 third-party-advisory
- oval:org.mitre.oval:def:19431 vdb-entry signature
- 20100124 [SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory mailing-list
- DSA-2207 vendor-advisory
- openSUSE-SU-2012:1700 vendor-advisory
- HPSBUX02860 vendor-advisory
- 40330 third-party-advisory
- MDVSA-2010:177 vendor-advisory
- 43310 third-party-advisory
- ADV-2010-1559 vdb-entry
- APPLE-SA-2010-03-29-1 vendor-advisory
- HPSBOV02762 vendor-advisory
- ADV-2010-1986 vdb-entry
- RHSA-2010:0580 vendor-advisory
- 40813 third-party-advisory
- 38541 third-party-advisory
- MDVSA-2010:176 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- USN-899-1 vendor-advisory
- http://support.apple.com/kb/HT4077
- SUSE-SR:2010:008 vendor-advisory
- openSUSE-SU-2013:0147 vendor-advisory
- 38687 third-party-advisory
- 38346 third-party-advisory
- http://tomcat.apache.org/security-5.html
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 37945 vdb-entry
- oval:org.mitre.oval:def:7092 vdb-entry signature
- RHSA-2010:0119 vendor-advisory
- RHSA-2010:0582 vendor-advisory
- 38316 third-party-advisory
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- ADV-2010-0213 vdb-entry
- HPSBST02955 vendor-advisory
- http://svn.apache.org/viewvc?rev=902650&view=rev
- apache-tomcat-war-directory-traversal(55857) vdb-entry
- openSUSE-SU-2012:1701 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list