CVE-2009-2902
NoneCVSS
—
EPSS
10.7%
Published
Jan 28, 2010
CISA due date
—
The record
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 5.5.0 | 5.5.29 |
| Maven | org.apache.tomcat:tomcat | 6.0.0 | 6.0.24 |
| Debian:5.0 | tomcat5.5 | 0 | 5.5.26-5lenny2 |
| Red Hat:certificate_system:7.3 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:certificate_system:7.3 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:certificate_system:7.3 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:certificate_system:7.3 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:certificate_system:7.3 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:certificate_system:7.3 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.19 |
| Red Hat:enterprise_linux:5::client | tomcat5 | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client | tomcat5-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5 | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5 | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:enterprise_linux:5::server | tomcat5-webapps | 0 | 0:5.5.23-0jpp.9.el5_5 |
| Red Hat:jboss_enterprise_web_server:1::el4 | glassfish-jsf | 0 | 0:1.2_13-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22 | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-devel | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-util | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-apr-util-devel | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-debuginfo | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-devel | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | httpd22-manual | 0 | 0:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-commons-chain | 0 | 0:1.2-2.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-commons-digester | 0 | 0:1.8.1-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-commons-io | 0 | 0:1.4-1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-commons-modeler | 0 | 0:2.0-3.3.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-commons-validator | 0 | 0:1.3.1-7.4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jakarta-oro | 0 | 0:2.0.8-3jpp.ep1.3.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jboss-javaee | 0 | 0:5.0.1-2.3.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jboss-javaee-poms | 0 | 0:5.0.1-2.3.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | jboss-transaction-1.0.1-api | 0 | 0:5.0.1-2.3.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_jk | 0 | 0:1.2.28-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_jk-ap20 | 0 | 0:1.2.28-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_jk-debuginfo | 0 | 0:1.2.28-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_jk-manual | 0 | 0:1.2.28-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | mod_ssl22 | 0 | 1:2.2.14-4.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | struts12 | 0 | 0:1.2.9-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat-native | 0 | 0:1.1.19-2.0.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat-native-debuginfo | 0 | 0:1.1.19-2.0.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5 | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-admin-webapps | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-common-lib | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-jasper | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-jasper-eclipse | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-jasper-javadoc | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-jsp-2.0-api | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-parent | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-server-lib | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-servlet-2.4-api | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat5-webapps | 0 | 0:5.5.28-7.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6 | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-admin-webapps | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-docs-webapp | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-el-1.0-api | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-javadoc | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-lib | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-log4j | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | tomcat6-webapps | 0 | 0:6.0.24-2.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | xerces-j2 | 0 | 0:2.9.1-2.2_patch_01.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el4 | xml-commons-resolver12 | 0 | 1:1.2-1.1.ep5.el4 |
| Red Hat:jboss_enterprise_web_server:1::el5 | glassfish-jsf | 0 | 0:1.2_13-3.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd | 0 | 0:2.2.14-1.2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd-devel | 0 | 0:2.2.14-1.2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | httpd-manual | 0 | 0:2.2.14-1.2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | jakarta-commons-chain | 0 | 0:1.2-2.1.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | jakarta-commons-io | 0 | 0:1.4-1.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | jakarta-oro | 0 | 0:2.0.8-3.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | mod_jk | 0 | 0:1.2.28-4.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | mod_jk-ap20 | 0 | 0:1.2.28-4.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | mod_jk-manual | 0 | 0:1.2.28-4.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | mod_ssl | 0 | 1:2.2.14-1.2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | struts12 | 0 | 0:1.2.9-2.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat-native | 0 | 0:1.1.19-2.0.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5 | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-admin-webapps | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-common-lib | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper-eclipse | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper-javadoc | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jsp-2.0-api | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-parent | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-server-lib | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-servlet-2.4-api | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-webapps | 0 | 0:5.5.28-7.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6 | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-admin-webapps | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-docs-webapp | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-el-1.0-api | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-javadoc | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-lib | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-log4j | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-webapps | 0 | 0:6.0.24-2.1.ep5.el5 |
| Red Hat:rhel_application_server:2 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.17 |
| Red Hat:rhel_application_server:2 | tomcat5-webapps | 0 | 0:5.5.23-0jpp_4rh.17 |
| maven | org.apache.tomcat/tomcat | 5.5.0 | No fix |
| maven | org.apache.tomcat/tomcat | 6.0.0 | No fix |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat