--- id: CVE-2021-24122 title: >- When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some con… summary: >- When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some con… severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-200 - CWE-706 vendor: apache product: tomcat affected: - 'tomcat >= 7.0.0, <= 7.0.106' - 'tomcat >= 8.5.0, <= 8.5.59' - 'tomcat >= 9.0.1, <= 9.0.39' - tomcat = 9.0.0 - tomcat = 10.0.0 - debian_linux = 9.0 - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.6 patched: - jboss_web_server_5_4_for_rhel_7_server - jboss_web_server_5_4_for_rhel 8 - fuse 7.11 - jboss_web_server 5 - support_for_spring_boot 2.3.10 published: '2021-01-14' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:34.143' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-24122' references: - url: 'http://www.openwall.com/lists/oss-security/2021/01/14/1' label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: 'https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html' label: security@apache.org - url: 'https://security.netapp.com/advisory/ntap-20210212-0008/' label: security@apache.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: security@apache.org - url: 'http://www.openwall.com/lists/oss-security/2021/01/14/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210212-0008/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-24122.json - url: 'https://access.redhat.com/security/cve/CVE-2021-24122' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1917209' - url: 'https://www.cve.org/CVERecord?id=CVE-2021-24122' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-24122' - url: >- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E - url: 'http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107' - url: 'http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60' - url: 'http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40' - url: 'https://access.redhat.com/errata/RHSA-2021:0494' - url: 'https://access.redhat.com/errata/RHSA-2022:5532' - url: 'https://access.redhat.com/errata/RHSA-2021:0495' - url: 'https://access.redhat.com/errata/RHSA-2021:3425' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.22852 epssPercentile: 0.97726 ingestedAt: '2026-08-25T17:29:31.017Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-10-08T20:57:54.522297Z' --- ## Overview When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. ## Affected - `tomcat >= 7.0.0, <= 7.0.106` - `tomcat >= 8.5.0, <= 8.5.59` - `tomcat >= 9.0.1, <= 9.0.39` - `tomcat = 9.0.0` - `tomcat = 10.0.0` - `debian_linux = 9.0` - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.6` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2021:0494** · Red Hat · fixed in: Red Hat JBoss Web Server 5.4 for RHEL 7 Server, Red Hat JBoss Web Server 5.4 for RHEL 8 · released 2021-02-11 · [advisory](https://access.redhat.com/errata/RHSA-2021:0494) - **RHSA-2022:5532** · Red Hat · fixed in: Red Hat Fuse 7.11 · released 2022-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:5532) - **RHSA-2021:0495** · Red Hat · fixed in: Red Hat JBoss Web Server 5 · released 2021-02-11 · [advisory](https://access.redhat.com/errata/RHSA-2021:0495) - **RHSA-2021:3425** · Red Hat · fixed in: Red Hat support for Spring Boot 2.3.10 · released 2021-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:3425) - **Red Hat VEX** · Moderate · affected: Red Hat JBoss Data Grid 6, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Fuse 6, Red Hat JBoss Web Server 3, Red Hat OpenStack Platform 10 (Newton), … · no fix planned: Red Hat JBoss Data Grid 6, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Fuse 6, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-24122.json)