CVE-2006-3835: Apache Tomcat

Medium severity, CVSS 5.0. EPSS: 46.2% chance of exploitation in the next 30 days.

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

Affected products

• Apache Tomcat: version 5.0.28 only; version 5.5.7 only; version 5.5.9 only; version 5.5.12 only; version 5.5.16 only

Published 2006-07-25. Last modified 2026-06-16.