Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through…
Priority HIGH 65CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Why it matters now
EPSS 0.99708 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed org.apache.tomcat:tomcat (Maven): 4.1.39, 5.5.27, 6.0.18Red Hat: 5 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 4.1.0 to before 4.1.39 | 4.1.39 | Patch available | GHSA-m7xj-ccqc-p4g2 |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.27 | 5.5.27 | Patch available | GHSA-m7xj-ccqc-p4g2 |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.18 | 6.0.18 | Patch available | GHSA-m7xj-ccqc-p4g2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 4.1.0 to before 4.1.39 Fixed in 4.1.39 Patch available GHSA-m7xj-ccqc-p4g2
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.27 Fixed in 5.5.27 Patch available GHSA-m7xj-ccqc-p4g2
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.18 Fixed in 6.0.18 Patch available GHSA-m7xj-ccqc-p4g2
Remediation
- Fix · GHSA-m7xj-ccqc-p4g2 org.apache.tomcat:tomcat (Maven) Fixed in 4.1.39 Advisory →
- Fix · GHSA-m7xj-ccqc-p4g2 org.apache.tomcat:tomcat (Maven) Fixed in 5.5.27 Advisory →
- Fix · GHSA-m7xj-ccqc-p4g2 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.18 Advisory →
Red Hat 5 advisories
- RHSA-2008:1007 Released 2008-12-08 · Red Hat rating Lowtomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- Red Hat Satellite 5.1 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- RHSA-2008:0862 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- RHSA-2008:0864 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) tomcat5-5.5.23-0jpp_12rh, tomcat5-common-lib-5.5.23-0jpp_12rh, tomcat5-jasper-5.5.23-0jpp_12rh +3
Show 2 more Red Hat advisories
- RHSA-2008:0877 Released 2008-09-22 · Red Hat rating Importantjbossweb security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
- RHSA-2008:0648 Released 2008-08-27 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-5.5.23-0jpp.7.el5_2.1.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-admin-webapps-5.5.23-0jpp.7.el5_2.1 +15
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2008:0862 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2008:0864 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server | Fixed | RHSA-2008:0877 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
| Red Hat Satellite 5.1 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-2938
- 2026-10-03 Alias added: GHSA-m7xj-ccqc-p4g2
References
Exploit 1
Advisory 24
- http://tomcat.apache.org/security-4.html
- RHSA-2008:0862
- ADV-2008-2823
- VU#343355
- FEDORA-2008-8130
- SUSE-SR:2008:018
- MDVSA-2008:188
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320
- RHSA-2008:0864
- ADV-2008-2343
- SUSE-SR:2009:004
- http://tomcat.apache.org/security-6.html
- 4148
- FEDORA-2008-7977
- FEDORA-2008-8113
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780
- HPSBUX02401
- http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
- APPLE-SA-2008-10-09
- http://support.apple.com/kb/HT3216
- RHSA-2008:0648
- https://nvd.nist.gov/vuln/detail/CVE-2008-2938
Other 30
- oval:org.mitre.oval:def:10587
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/c55ad56ed72ee1dbfe790bc5492d4df74e3e754f
- https://web.archive.org/web/20090207111236/http://secunia.com/advisories/33797
- https://web.archive.org/web/20090308065055/http://secunia.com/advisories/31865
- https://web.archive.org/web/20100516085845/http://secunia.com/advisories/37297
- https://web.archive.org/web/20110711210039/http://rhn.redhat.com/errata/RHSA-2008-0862.html
- https://web.archive.org/web/20110713233239/http://rhn.redhat.com/errata/RHSA-2008-0648.html
- https://web.archive.org/web/20110713234158/http://rhn.redhat.com/errata/RHSA-2008-0864.html
- https://web.archive.org/web/20140628064423/http://www.securityfocus.com/archive/1/495318/100/0/threaded
- https://web.archive.org/web/20140628064448/http://www.securityfocus.com/archive/1/507729/100/0/threaded
- https://web.archive.org/web/20140826163457/http://www.securityfocus.com/bid/30633
- https://web.archive.org/web/20140826171227/http://www.securitytracker.com/id?1020665
- https://web.archive.org/web/20140826232500/http://www.securityfocus.com/bid/31681
- https://web.archive.org/web/20140827130327/http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
- https://web.archive.org/web/20200612070417/http://marc.info/?l=bugtraq&m=123376588623823&w=2
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- https://web.archive.org/web/20080827130946/http://securityreason.com/securityalert/4148
- https://web.archive.org/web/20090201124623/http://secunia.com/advisories/31639
- https://web.archive.org/web/20090201124633/http://secunia.com/advisories/31891
- https://web.archive.org/web/20090201124638/http://secunia.com/advisories/32120
- https://web.archive.org/web/20090201124957/http://secunia.com/advisories/31982
- https://web.archive.org/web/20090201125002/http://secunia.com/advisories/32266
- https://web.archive.org/web/20090201141000/http://secunia.com/advisories/32222
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2008-2938 · CVE Program
- CVE-2008-2938 · NVD
- FIRST EPSS
- GHSA-m7xj-ccqc-p4g2 · GitHub Advisory Database · CC BY 4.0
- CVE-2008-2938 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences