Path traversal in Apache Tomcat
Priority MEDIUM 45CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Why it matters now
EPSS 0.1014 95th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 9.0.0.M22, 8.5.16
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.0.M21; 8.5.0 to 8.5.15 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.0.M1 to before 9.0.0.M22 | 9.0.0.M22 | Patch available | GHSA-68g5-8q7f-m384 |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.0 to before 8.5.16 | 8.5.16 | Patch available | GHSA-68g5-8q7f-m384 |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.0.M21; 8.5.0 to 8.5.15 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M22 Fixed in 9.0.0.M22 Patch available GHSA-68g5-8q7f-m384
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.16 Fixed in 8.5.16 Patch available GHSA-68g5-8q7f-m384
CPE configurations NVD · 37
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* | 8.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* | 8.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* | 8.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* | 8.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* | 8.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* | 8.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* | 8.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* | 8.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* | 8.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* | 8.5.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:* Versions 8.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:* Versions 8.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:* Versions 8.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:* Versions 8.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:* Versions 8.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:* Versions 8.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:* Versions 8.5.9 Vulnerable ·Apache
Show 27 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* | 8.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* | 8.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* | 8.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:* | 8.5.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:* | 8.5.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:* | 8.5.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:* Versions 8.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:* Versions 8.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:* Versions 8.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:* Versions 8.5.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:* Versions 8.5.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:* Versions 8.5.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Remediation
- Fix · GHSA-68g5-8q7f-m384 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.0.M22 Advisory →
- Fix · GHSA-68g5-8q7f-m384 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.16 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Tomcat — DSA-3974
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2017-05310 Insufficient verification of data authenticity in Apache TomcatPriority LOW 31
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat JBoss Enterprise Web Server 3
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7675
- 2026-10-03 Alias added: GHSA-68g5-8q7f-m384
References
Other 32
- https://security.netapp.com/advisory/ntap-20180614-0003/
- [announce] 20170810 [UPDATE][SECURITY] CVE-2017-7675 Apache Tomcat Security Constraint Bypass
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190612 [Bug 61120] Tomcat 8.5.15 with HTTP/2: URL path parameters lost
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/cf181edc9a8c239cde704cffc3c503425bdcae2b
- https://github.com/apache/tomcat/commit/dacb030b85fe0e0b3da87469e23d0f31252fdede
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d3a5818e8af731bde6a05ef031ed3acc093c6dd7c4bfcc4936eafd6c@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180614-0003
- https://svn.apache.org/viewvc?view=revision&revision=1796090
- https://web.archive.org/web/20170929163331/http://www.securityfocus.com/bid/100256
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5f8ab8a02f3610bd56ea2b0d69af25cbde451d79c46276c350e05a15@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
- https://bz.apache.org/bugzilla/show_bug.cgi?id=61120
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2017-7675 · CVE Program
- CVE-2017-7675 · NVD
- FIRST EPSS
- GHSA-68g5-8q7f-m384 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7675 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences