CVE-2008-2938 Public exploit EPSS 99.7%

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through…

Summary

Apache Tomcat versions 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 contain a directory traversal flaw in the handling of request URIs. An unauthenticated remote attacker can read arbitrary files on the server by sending encoded directory traversal sequences in the URI, provided that allowLinking and UTF-8 are enabled in the configuration.

Official description · CVE.org

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Breakdown

27.7 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 2 days before disclosure.

Public exploit codeExploit-DB11 Aug 20082 days before
Disclosed13 Aug 2008day 0

See the family tree

A fix was bypassed or incomplete once over 9 years. The latest fix listed for tomcat is 6.0.20.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2005-2090Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24…30 Jun 2005
same family
This CVECVE-2008-2938Directory traversal vulnerability in Apache Tomcat 4.1.0 through…13 Aug 2008
same family
CVE-2010-2227Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0…13 Jul 2010
same family
CVE-2011-3190Certain AJP protocol connector implementations in Apache Tomcat…31 Aug 2011
relatedHigh
Why these are linked:
- Fixed one release later7.0.21 → 7.0.22 (org.apache.tomcat:tomcat)
- Same code patched: AbstractAjpProcessor.java, AjpAprProcessor.java, AjpNioProcessor.java, AjpProcessor.java (machine-matched)Functions: processcommit a2538ce commit 9eae334
CVE-2011-3375Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not…19 Jan 2012
relatedMedium
Why these are linked:
- Same code patched: AbstractAjpProcessor.java, AbstractHttp11Processor.java (machine-matched)Functions: prepareRequestcommit 9eae334 commit 41b90b6 commit 7c04000
CVE-2013-4286Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before…26 Feb 2014

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.0.17CVE-2008-12324 Aug 2008
6.0.18CVE-2008-19474 Jun 2008
6.0.18CVE-2008-23704 Aug 2008
6.0.18CVE-2008-293813 Aug 2008
6.0.19CVE-2009-05805 Jun 2009
6.0.20CVE-2009-07819 Mar 2009
6.0.20CVE-2008-551516 Jun 2009Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-m7xj-ccqc-p4g2

Upgrade to 6.0.35 or later

Fixes this CVE and 8 other known vulnerabilities in this package (CVE-2007-0450, CVE-2007-2449, +6).

Set the version to 6.0.35 or later in your pom.xml or build.gradle.

First fixed in 6.0.18 for CVE-2008-2938.

Affected versions, by release line

If you run	Upgrade to
6.0.0 up to 6.0.18	6.0.35first fix for this CVE: 6.0.18
5.5.0 up to 5.5.27	5.5.35first fix for this CVE: 5.5.27
4.1.0 up to 4.1.39	4.1.40first fix for this CVE: 4.1.39

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 15 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

CVE’s31 Oct 2026
A Hidden Project Link Can Make Claude Code Silently Send Your Files to an Attacker31 Oct 2026
Untitled8 Sep 2026
credit: OctoSeek [•Sakula Rat | Porn Name Change•]15 May 2026
Eksploatacja: Java/CVE-2010-0094/CVE-2008-5353/CVE-2012-050717 Oct 2024
vgt.pl (VGT.pl) or plix.pl (plix.net) 104.21.40.140 172.67.186.22916 Oct 2024
9 more on OTX

References

43 links, grouped by NVD tag

x_refsource_CONFIRM 5

tomcat.apache.org/security-4.html support.avaya.com/elmodocs2/security/ASA-2008-401.htm tomcat.apache.org/security-6.html tomcat.apache.org/security-5.html support.apple.com/kb/HT3216

third-party-advisory 11

secunia.com/advisories/37297 secunia.com/advisories/31982 secunia.com/advisories/32120 kb.cert.org/vuls/id/343355 secunia.com/advisories/31865 secunia.com/advisories/31639 secunia.com/advisories/32222 secunia.com/advisories/31891

Show 3 moreShow fewer

secunia.com/advisories/33797 securityreason.com/securityalert/4148 secunia.com/advisories/32266

vendor-advisory 11

redhat.com/support/errata/RHSA-2008-0862.html redhat.com/archives/fedora-package-announce/2008-September/msg00889.html lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html mandriva.com/security/advisories?name=MDVSA-2008:188 redhat.com/support/errata/RHSA-2008-0864.html lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html redhat.com/archives/fedora-package-announce/2008-September/msg00712.html redhat.com/archives/fedora-package-announce/2008-September/msg00859.html

Show 3 moreShow fewer

marc.info/?l=bugtraq&m=123376588623823&w=2 lists.apple.com/archives/security-announce/2008/Oct/msg00001.html redhat.com/support/errata/RHSA-2008-0648.html

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4516

Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)EDB-6229 · remote · multiple · 2008-08-11 · verified
Apache Tomcat < 6.0.18 - 'utf8' Directory TraversalEDB-14489 · remote · unix · 2010-07-28 · verified

, 31 Oct 2026

99.7%Top 0.05%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.95%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9995 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 PoC-in-GitHub repo; 2 Metasploit modules 5.0/5

Mentioned in OTX pulses15 pulses 2.7/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total27.7

Record

Published: 13 Aug 2008
Modified: 7 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 15 community threat pulses (AlienVault OTX)

References

x_refsource_CONFIRM 5

third-party-advisory 11

vendor-advisory 11

vdb-entry 9

exploit 1

mailing-list 5

x_refsource_MISC 1

techniques