CVE-2017-12616: Apache Tomcat

High severity, CVSS 7.5. EPSS: 70.1% chance of exploitation in the next 30 days.

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Affected products

• Apache Tomcat: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; version 7.0.5 only; …

Published 2017-09-19. Last modified 2026-06-17.