UpHeron
All vulnerabilities

Servers and applications

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists…

Severity
Medium 4.3
Published
13 Aug 2008
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Exploit chance
100% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Path traversal (CWE-22)
Attack
Over the network · No login needed
Attacker can
Read some data
CVSS vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
Sources
NVD

Description

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

From NVD.

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 4.0.0 up to 4.1.37
  • From 5.0.0 up to 5.5.26
  • From 6.0.0 up to 6.0.16

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2008-2938
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2008-2938