CVE-2010-3718: Apache Tomcat

Low severity, CVSS 1.2. EPSS: 1.3% chance of exploitation in the next 30 days.

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

Affected products

• Apache Tomcat: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 6.0 only; version 6.0.0 only; …

Published 2011-02-10. Last modified 2026-06-16.