FlawAtlas
Search the atlas
CVE-2015-5174 Moderate

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Exploit probability 12.6%
Published May 14, 2022
Required by Not available
Last source change August 28, 2025

02 / AFFECTED SOFTWARE

Affected packages

Maven org.apache.tomcat:tomcat

40 explicit affected versions

04 / EVIDENCE

Source records

Open Source Vulnerabilities GHSA-6qr6-x7jm-x2q6

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

View original source

05 / REFERENCES

Further evidence