CVE-2009-2693: Apache Tomcat

Medium severity, CVSS 5.8. EPSS: 9.6% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

Affected products

• Apache Tomcat: version 5.5.0 only; version 5.5.1 only; version 5.5.2 only; version 5.5.3 only; version 5.5.4 only; version 5.5.5 only; …

Published 2010-01-28. Last modified 2026-06-16.