CVE-2010-3718: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Summary
CVE-2010-3718: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.30
>= 6.0.0, < 6.0.30
>= 7.0.0, < 7.0.4
Fixed in 5.5.30, 6.0.30 or 7.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a runtime environment for Java code to run and process HTTP requests. The vulnerability identified as CVE-2010-3718 affects Apache Tomcat versions 7.0.0 through 7.0.3, 6.0.x, and 5.5.x when running within a SecurityManager. This vulnerability allows local web applications to read or write files outside of the intended working directory through a directory traversal attack. This means that an attacker can access sensitive files on the server or modify files that they should not have access to.
Vulnerability Detail
The vulnerability arises from the fact that Apache Tomcat does not properly restrict access to the ServletContext attribute when running within a SecurityManager. This attribute is meant to provide read-only access to the web application's resources. However, due to the lack of proper restrictions, a local web application can bypass this limitation and read or write files outside of its intended working directory. This can be exploited by an attacker to gain unauthorized access to sensitive files or modify files on the server.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.305.5.30 -
>= 6.0.0, < 6.0.306.0.30 -
>= 7.0.0, < 7.0.47.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version of Apache Tomcat is not immediately feasible, a possible workaround is to disable the use of the SecurityManager. However, this workaround may have implications on the overall security of the web application and should be carefully evaluated before implementation. To disable the SecurityManager, the following steps can be taken:
- Locate the Tomcat configuration file (e.g., catalina.properties).
- Find the line that sets the 'security.manager' property.
- Comment out or remove this line.
- Save the changes and restart the Tomcat server.
It is important to note that disabling the SecurityManager should only be considered as a temporary solution until the upgrade to a fixed version can be performed.
Conclusion
The vulnerability identified as CVE-2010-3718 in Apache Tomcat allows local web applications to read or write files outside of their intended working directory. This can lead to unauthorized access to sensitive files or the modification of critical system files. To fix this vulnerability, it is recommended to upgrade to Apache Tomcat versions 7.0.4, 6.0.30, or 5.5.30, which address the issue. If immediate upgrade is not feasible, disabling the SecurityManager can serve as a temporary workaround, although this may have security implications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows local web applications to read or write files outside of their intended working directory. This can lead to unauthorized access to sensitive files or the modification of critical system files.
An attacker can exploit this vulnerability by crafting a malicious web application that performs a directory traversal attack. By bypassing the restrictions on the ServletContext attribute, the attacker can access files outside of the web application's directory.
No, only Apache Tomcat versions 7.0.0 through 7.0.3, 6.0.x, and 5.5.x running within a SecurityManager are affected. Upgrading to fixed versions or disabling the SecurityManager can mitigate the vulnerability.
Yes, a possible workaround is to disable the SecurityManager. However, this may have implications on the overall security of the web application and should be carefully evaluated before implementation.
Yes, the vulnerability has been fixed in Apache Tomcat versions 7.0.4, 6.0.30, and 5.5.30. It is recommended to upgrade to these versions or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
