Anmelden
Deutsch English Español Polski
Hoch

Apache Tomcat Vulnerable to Relative Path Traversal

  • Veröffentlicht: 27.10.2025
  • Aktualisiert: 11.10.2026 13:20

The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Java / Kotlin (Maven) org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
Java / Kotlin (Maven) org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
Java / Kotlin (Maven) org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109

Verweise

CVSS-Wert 7.5/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Schwäche (CWE)
CWE-23
Plattform
Java / Kotlin (Maven)
Paket
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina
Veröffentlicht
27.10.2025
Aktualisiert
11.10.2026 13:20

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-wmwf-9ccg-fff5 - CC BY 4.0

Schwachstellenhistorie: org.apache.tomcat:tomcat

Alle veröffentlichten Schwachstellen dieses Pakets (Java / Kotlin (Maven)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (162) im Archiv
Einträge insgesamt
162
Erste → letzte
12.2018 08.2026
Ohne Fix
20
In Angriffen ausgenutzt
1

Verteilung nach Schweregrad

  • Kritisch 8
  • Hoch 40
  • Mittel 102
  • Niedrig 12

Veröffentlichungen pro Jahr

Schweregrad:
  1. Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
    Kritisch · 9.8 CVE-2026-65905 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0.M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.30, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  2. Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
    Kritisch · 9.1 CVE-2026-65182 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  3. Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
    Kritisch · 9.1 CVE-2026-68525 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  4. Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
    Hoch · 7.5 CVE-2026-41284 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  5. Apache Tomcat - Digest authenticator will authenticate any unknown user
    Kritisch · 9.8 CVE-2026-43512 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  6. Apache Tomcat: LockOutRealm treats user names as case-sensitive
    Hoch · 7.5 CVE-2026-43513 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  7. Apache Tomcat - Security constraints not correctly applied
    Kritisch · 9.1 CVE-2026-43515 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  8. Apache Tomcat - WebSocket authentication header exposure
    Hoch · 7.3 CVE-2026-42498 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  9. Apache Tomcat - HTTP/2 request headers not validated
    Kritisch · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  10. Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
    Hoch · 7.5 CVE-2026-34487 >= 9.0.13, < 9.0.117, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.117, 10.1.54, 11.0.21
  11. Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
    Hoch · 7.5 CVE-2026-34483 >= 9.0.40, < 9.0.116, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.116, 10.1.54, 11.0.21
  12. Apache Tomcat Missing Encryption of Sensitive Data vulnerability
    Hoch · 7.5 In Angriffen ausgenutzt CVE-2026-34486 >= 11.0.20, < 11.0.21, >= 10.1.53, < 10.1.54, >= 9.0.116, < 9.0.117 11.0.21, 10.1.54, 9.0.117
  13. Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
    Hoch · 7.5 CVE-2026-29146 >= 9.0.13, < 9.0.116, >= 10.1.50, < 10.1.53, >= 11.0.0-M1, < 11.0.20, >= 8.5.38, <= 8.5.100, >= 7.0.100, <= 7.0.109 9.0.116, 10.1.53, 11.0.20
  14. Apache Tomcat: CLIENT_CERT authentication does not fail as expected
    Kritisch · 9.1 CVE-2026-29145 >= 9.0.83, < 9.0.116, >= 10.1.0-M7, < 10.1.53, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  15. Apache Tomcat: Configured cipher preference order not preserved
    Hoch · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  16. Apache Tomcat Vulnerable to Relative Path Traversal dieser Eintrag
    Hoch · 7.5 CVE-2025-55752 >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
  17. Deserialization of Untrusted Data in Apache Tomcat
    Hoch CVE-2013-2185 < 7.0.39 7.0.39
  18. Improper Neutralization of Input During Web Page Generation in Apache Tomcat
    Hoch · 8.1 CVE-2015-5346 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.31, >= 7.0.0, < 7.0.66 9.0.0.M2, 8.0.31, 7.0.66
  19. Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
    Hoch · 8.8 CVE-2015-5351 < 7.0.68, >= 8.0.0, < 8.0.31, >= 9.0.0.M0, < 9.0.0.M2 7.0.68, 8.0.31, 9.0.0.M2
  20. Apache Tomcat does not enforce the maxHttpHeaderSize limit
    Hoch · 7.5 CVE-2011-0534 >= 6.0.0, < 6.0.32, >= 7.0.0, < 7.0.8 6.0.32, 7.0.8
  21. Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
    Hoch CVE-2011-3190 >= 7.0.0, < 7.0.21, >= 6.0.0, < 6.0.34, >= 5.0.0, < 5.5.34 7.0.21, 6.0.34, 5.5.34
  22. Uncontrolled Resource Consumption in Apache Tomcat
    Hoch CVE-2014-0230 >= 6.0.0, < 6.0.44, >= 7.0.0, < 7.0.55, >= 8.0.0, < 8.0.9 6.0.44, 7.0.55, 8.0.9
  23. Improper Access Control in Apache Tomcat
    Hoch · 8.8 CVE-2016-0714 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.32, >= 7.0.0, < 7.0.70, >= 6.0.0, < 6.0.46 9.0.0.M2, 8.0.32, 7.0.70, 6.0.46
  24. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    Hoch · 7.5 CVE-2016-6817 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8 9.0.0.M12, 8.5.8
  25. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    Hoch · 7.5 CVE-2017-5647 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13, >= 8.0.0, < 8.0.43, >= 7.0.0, < 7.0.77, >= 6.0.0, < 6.0.53 9.0.0.M19, 8.5.13, 8.0.43, 7.0.77, 6.0.53
  26. Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request
    Hoch · 7.5 CVE-2016-8747 >= 8.5.7, < 8.5.10, >= 9.0.0.M11, < 9.0.0.M16 8.5.10, 9.0.0.M16
  27. Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
    Hoch · 7.5 CVE-2017-7675 >= 9.0.0.M1, < 9.0.0.M22, >= 8.5.0, < 8.5.16 9.0.0.M22, 8.5.16
  28. Improper socket reuse in Apache Tomcat
    Hoch · 8.6 CVE-2022-25762 >= 8.5.0, < 8.5.75, >= 9.0.0M1, < 9.0.20 8.5.75, 9.0.20
  29. Improper Handling of Exceptional Conditions in Apache Tomcat
    Hoch · 7.5 CVE-2017-5664 >= 9.0.0.M1, < 9.0.0.M21, >= 8.5.0, < 8.5.15, >= 8.0.0, < 8.0.44, >= 7.0.0, < 7.0.78 9.0.0.M21, 8.5.15, 8.0.44, 7.0.78
  30. Improper Resource Shutdown or Release in Apache Tomcat
    Hoch · 7.5 CVE-2017-5650 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  31. Apache Tomcat vulnerable to SecurityManager bypass
    Hoch · 7.5 CVE-2016-6796 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0.RC1, < 8.0.37, >= 7.0.0, < 7.0.71, >= 6.0.0, < 6.0.46 9.0.0.M10, 8.5.5, 8.0.37, 7.0.71, 6.0.46
  32. Incorrect Authorization in Apache Tomcat
    Hoch · 7.5 CVE-2016-6797 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0, < 8.0.37, >= 7.0.0, < 7.0.72 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72
  33. Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption
    Hoch · 7.5 CVE-2022-29885 >= 10.1.0-M1, < 10.1.0-M15, >= 10.0.0-M1, < 10.0.21, >= 9.0.13, < 9.0.63, >= 8.5.38, < 8.5.79 10.1.0-M15, 10.0.21, 9.0.63, 8.5.79
  34. Apache Tomcat affected by vulnerability in TLS and SSL protocol
    Kritisch · 9.8 CVE-2009-3555 >= 7.0.0, < 7.0.10, >= 6.0.0, < 6.0.32, >= 5.0.0, < 5.5.33 7.0.10, 6.0.32, 5.5.33
  35. Apache Tomcat Buffer Over-Read
    Hoch CVE-2006-7197 <= 5.5.15 keine Korrektur
  36. Apache Tomcat allows remote attackers to read JSP source files
    Hoch CVE-2005-4836 >= 4.1.15, <= 4.1.40 keine Korrektur
  37. Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests
    Hoch CVE-2005-3510 >= 5.5.0, < 5.5.12 5.5.12
  38. Apache Tomcat DoS via Malicious Get Request
    Hoch CVE-2002-2272 >= 4.0.0, <= 4.1.12 keine Korrektur
  39. Apache Tomcat Source Code Disclosure
    Hoch CVE-2002-1394 < 4.0.6 4.0.6
  40. Apache Tomcat may be started without proper security settings
    Hoch CVE-2002-0493 < 4.0b7 4.0b7
Mehr anzeigen (8) 40 von 48 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.