CVE-2016-6794: System Property Disclosure in Apache Tomcat
Summary
CVE-2016-6794: System Property Disclosure in Apache Tomcat. Affects org.apache.tomcat:tomcat across 5 version ranges.
>= 6.0.0, < 6.0.47
>= 7.0.0, < 7.0.72
>= 8.0.0, < 8.0.37
>= 8.1.0, < 8.5.5
>= 9.0.0.M1, < 9.0.0.M10
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2016-6794 allows a malicious web application to bypass the SecurityManager and read system properties that should not be visible. This vulnerability affects Apache Tomcat versions 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0 to 8.0.36, 8.5.0 to 8.5.4, and 9.0.0.M1 to 9.0.0.M9.
Vulnerability Detail
The system property replacement feature for configuration files in Apache Tomcat can be exploited by a malicious web application to bypass the SecurityManager and gain access to system properties that should not be visible. This can lead to the disclosure of sensitive information and potentially enable further attacks. The vulnerability affects multiple versions of Apache Tomcat and can be exploited if a SecurityManager is configured.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.476.0.47 -
>= 7.0.0, < 7.0.727.0.72 -
>= 8.0.0, < 8.0.378.0.37 -
>= 8.1.0, < 8.5.58.5.5 -
>= 9.0.0.M1, < 9.0.0.M109.0.0.M10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of Apache Tomcat as mentioned in the 'how_to_fix' section.
Conclusion
The system property disclosure vulnerability in Apache Tomcat can be exploited by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
This vulnerability allows a malicious web application to bypass the SecurityManager and read system properties that should not be visible. This can lead to the disclosure of sensitive information and potentially enable further attacks.
The vulnerability affects Apache Tomcat versions 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0 to 8.0.36, 8.5.0 to 8.5.4, and 9.0.0.M1 to 9.0.0.M9.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. The fixed versions are 6.0.47, 7.0.72, 8.0.37, 8.5.5, and 9.0.0.M10.
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of Apache Tomcat.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
