CVE-2008-2938
Apache Tomcat Directory Traversal vulnerability
4.3 MediumPublic exploitFix available
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Exploit likelihood
99.7%Up 19.6 points since Feb 4, 2022
What each source reports
NVD Score used
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- Record
CVE-2008-2938- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- Record
CVE-2008-2938- Updated
- 2026-11-02
EUVDEUVD-2022-4516 No score
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- Record
EUVD-2022-4516- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7xj-ccqc-p4g2 No score
Apache Tomcat Directory Traversal vulnerability
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- Record
GHSA-m7xj-ccqc-p4g2- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-m7xj-ccqc-p4g2 No score
Apache Tomcat Directory Traversal vulnerability
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- Record
GHSA-m7xj-ccqc-p4g2- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
4.1.0 to 4.1.37 | 4.1.39 |
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.26 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.16 | 6.0.18 |
org.apache.tomcat:tomcatMaven |
4.1.0 up to 4.1.39 | 4.1.39 |
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.27 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.18 | 6.0.18 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
Show 45 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el4 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el4 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el5 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el5 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
tomcat5Red Hat:network_satellite:5.1::el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC) | 2008-08-11 |
| Exploit-DB | Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal | 2010-07-28 |
| PoC in GitHub | Naramsim/Offensive | 2016-10-13 |
| Metasploit | Tomcat UTF-8 Directory Traversal Vulnerability | 2009-01-09 |
| Metasploit | TrendMicro Data Loss Prevention 5.5 Directory Traversal | 2009-01-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2938 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published August 13, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.7%, the 99th percentile. Fixed in org.apache.tomcat:tomcat 4.1.39.
References
tomcat.apache.org/security-4.html
secunia.com/advisories/37297
redhat.com/support/errata/RHSA-2008-0862.html
vupen.com/english/advisories/2008/2823
securityfocus.com/bid/31681
Show 102 moreShow less
kb.cert.org/vuls/id/343355
exchange.xforce.ibmcloud.com/vulnerabilities/44411
lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10587
securitytracker.com/id?1020665
mandriva.com/security/advisories?name=MDVSA-2008:188
support.avaya.com/elmodocs2/security/ASA-2008-401.htm
exploit-db.com/exploits/6229
securityreason.com/securityalert/4148
marc.info?l=bugtraq&m=123376588623823&w=2
securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
support.apple.com/kb/HT3216
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2008-2938
github.com/apache/tomcat/commit/c55ad56ed72ee1dbfe790bc5492d4df74e3e754f
web.archive.org/web/20080827130946/http://securityreason.com/securityalert/4148
access.redhat.com/errata/RHSA-2008:0648
bugzilla.redhat.com/show_bug.cgi?id=446393
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0648.json
cve.org/CVERecord?id=CVE-2008-1232