Which products and versions are affected by CVE-2007-5461?

Affected: Tomcat (Apache) versions 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0; tomcat5.5 (debian); tomcat5 (debian), among others. The full list is in the CVE brief.

Is CVE-2007-5461 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2007-5461 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2007-5461?

Public exploit code is available.

Is there a fix for CVE-2007-5461?

Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, avalon-logkit 0:1.2-2jpp_4rh, axis 0:1.2.1-1jpp_3rh.

How urgently should CVE-2007-5461 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

WatchlistLow

CVE-2007-5461Tomcat Path Traversal

Apache Tomcat Path Traversal Vulnerability

Published May 1, 2022 · Updated Mar 9, 2026 · Also known as GHSA-v5p2-vg3c-pmrr

Key Facts

Routine patching

CVE-2007-5461 is a low-severity vulnerability (CVSS 3.5 v2) affecting Tomcat (Apache), tomcat5.5 (debian), tomcat5 (debian) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 40% probability of exploitation in the next 30 days.
Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, avalon-logkit 0:1.2-2jpp_4rh, axis 0:1.2.1-1jpp_3rh.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Scores

CVSS v2

3.5

AV:N/AC:M/Au:S/C:P/I:N/A:N

EPSS (30-day exploit likelihood)

40%

Higher than 98.6% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

41/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2007-5461
advisoryRHSA-2008:0042
advisoryRHSA-2008:0151
advisoryRHSA-2008:0158
advisoryRHSA-2008:0195
advisoryRHSA-2008:0213

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

Affected Products

129 affected entries in total

Product	Affected versions	Fixed in
TomcatApache	4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0	n/a
tomcat5.5debian	See advisory	5.5.20-2etch1
tomcat5debian	See advisory	5.0.30-12etch1
org.apache.tomcat:tomcatmaven	>= 4.0.0	n/a
tomcat5-admin-webappsoracle	See advisory	5.5.23-0jpp.3.0.3.el5_1

20 more affected products in the full CVE brief

Patched Releases

ant

0:1.6.5-1jpp_1rh

avalon-logkit

0:1.2-2jpp_4rh

axis

0:1.2.1-1jpp_3rh

classpathx-jaf

0:1.0-2jpp_6rh

classpathx-mail

0:1.1.1-2jpp_8rh

concurrent

0:1.3.4-7jpp.ep1.6.el4

geronimo-specs

0:1.0-0.M4.1jpp_10rh

glassfish-jaf

0:1.1.0-0jpp.ep1.10.el4

glassfish-javamail

0:1.4.0-0jpp.ep1.8

glassfish-jsf

0:1.2_04-1.p02.0jpp.ep1.18

glassfish-jstl

0:1.2.0-0jpp.ep1.2

hibernate3

0:3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1, 1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4

hibernate3-annotations

0:3.2.1-1.patch02.1jpp.ep1.2.el4, 0:3.2.1-1.patch02.1jpp.ep1.2.el5.1

hibernate3-entitymanager

0:3.2.1-1jpp.ep1.6.el4

hsqldb

1:1.8.0.8-2.patch01.1jpp.ep1.1

jabberd

0:2.0s10-3.38.rhn

jacorb

0:2.3.0-1jpp.ep1.4, 0:2.3.0-1jpp.ep1.5.el5

jakarta-commons-modeler

0:2.0-3jpp_2rh

java

1.4.2-ibm-0:1.4.2.10-1jpp.2.el3, 1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

jboss-aop

0:1.5.5-1.CP01.0jpp.ep1.1.el4, 0:1.5.5-1.CP01.0jpp.ep1.1.el5

jboss-cache

0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el4, 0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el5

jboss-common

0:1.2.1-0jpp.ep1.2

jboss-remoting

0:2.2.2-3.SP4.0jpp.ep1.1, 0:2.2.2-3.SP4.0jpp.ep1.1.el5

jboss-seam

0:1.2.1-1.ep1.3.el4, 0:1.2.1-1.ep1.3.el5

jbossas

0:4.2.0-3.GA_CP02.ep1.3.el4, 0:4.2.0-4.GA_CP02.ep1.3.el5.3

Timeline

Publicly disclosed
May 1, 2022
Last updated
Mar 9, 2026

Weakness Type

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Affected: Tomcat (Apache) versions 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0; tomcat5.5 (debian); tomcat5 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, avalon-logkit 0:1.2-2jpp_4rh, axis 0:1.2.1-1jpp_3rh.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2007-5461 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.