CVE-2015-5174Medium· 4.3▾ Sunlit

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent direct…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score26/ 100 · Low

impact 23.7 · likelihood 2.5 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 25, 2016

Updated

Oct 14, 2026

CVSS

4.3

Vendor

apache

Product

tomcat

CWE

CWE-22

Depth score

26 · Low

EPSS

13% · p96

Platforms

—

Source

NVD

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

decided 2026-10-14

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 14.

13% → 13%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 3884 days

Feb 25, 2016Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
13%

apache CWE-22 #nvd #cve.org

Affected

debian_linux = 7.0
debian_linux = 8.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.4
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.16
tomcat = 6.0.18
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37
tomcat = 6.0.39
tomcat = 6.0.41
tomcat = 6.0.43
tomcat = 6.0.44
tomcat = 7.0.0
tomcat = 7.0.2
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.14
tomcat = 7.0.16
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.37
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.47
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 7.0.53
tomcat = 7.0.54
tomcat = 7.0.55
tomcat = 7.0.56
tomcat = 7.0.57
tomcat = 7.0.59
tomcat = 7.0.61
tomcat = 7.0.62
tomcat = 7.0.63
tomcat = 7.0.64
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.11
tomcat = 8.0.12
tomcat = 8.0.14
tomcat = 8.0.15
tomcat = 8.0.17
tomcat = 8.0.18
tomcat = 8.0.20
tomcat = 8.0.21
tomcat = 8.0.22
tomcat = 8.0.23
tomcat = 8.0.24
tomcat = 8.0.26
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 15.10
ubuntu_linux = 16.04

Full technical detail▾

Overview

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Affected

debian_linux = 7.0
debian_linux = 8.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.4
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.16
tomcat = 6.0.18
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37
tomcat = 6.0.39
tomcat = 6.0.41
tomcat = 6.0.43
tomcat = 6.0.44
tomcat = 7.0.0
tomcat = 7.0.2
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.14
tomcat = 7.0.16
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.37
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.47
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 7.0.53
tomcat = 7.0.54
tomcat = 7.0.55
tomcat = 7.0.56
tomcat = 7.0.57
tomcat = 7.0.59
tomcat = 7.0.61
tomcat = 7.0.62
tomcat = 7.0.63
tomcat = 7.0.64
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.11
tomcat = 8.0.12
tomcat = 8.0.14
tomcat = 8.0.15
tomcat = 8.0.17
tomcat = 8.0.18
tomcat = 8.0.20
tomcat = 8.0.21
tomcat = 8.0.22
tomcat = 8.0.23
tomcat = 8.0.24
tomcat = 8.0.26
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 15.10
ubuntu_linux = 16.04

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org