CVE-2009-2902: Apache Tomcat

Medium severity, CVSS 4.3. EPSS: 10.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

Affected products

• Apache Tomcat: version 5.5.0 only; version 5.5.1 only; version 5.5.2 only; version 5.5.3 only; version 5.5.4 only; version 5.5.5 only; …

Published 2010-01-28. Last modified 2026-06-16.