VYPR
← All advisories
Low severityNVD Advisory· Published Oct 15, 2007· Updated Apr 23, 2026

CVE-2007-5461

CVE-2007-5461

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcatMaven
>= 4.0.0, <= 4.0.6—
org.apache.tomcat:tomcatMaven
>= 5.5.0, <= 5.5.25—
org.apache.tomcat:tomcatMaven
>= 6.0.0, <= 6.0.14—

Affected products

44
  • Apache/Tomcat44 versions
    cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*+ 43 more
    • cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*

Patches

2
1e7b31e24801

Fix CVE-2007-5461.

https://github.com/apache/tomcatMark ThomasOct 18, 2007via ghsa
commit
3 files changed · +5 −5
  • java/org/apache/catalina/servlets/WebdavServlet.java+1 −0 modified
    @@ -243,6 +243,7 @@ protected DocumentBuilder getDocumentBuilder()
         try {
             documentBuilderFactory = DocumentBuilderFactory.newInstance();
             documentBuilderFactory.setNamespaceAware(true);
+            documentBuilderFactory.setExpandEntityReferences(false);
             documentBuilder = documentBuilderFactory.newDocumentBuilder();
         } catch(ParserConfigurationException e) {
             throw new ServletException
  • STATUS+0 −5 modified
    @@ -42,11 +42,6 @@ PATCHES PROPOSED TO BACKPORT:
   +1: fhanik,funkman
   -1: 
   
-* Fix important vulnerability when webdav is enabled for write
-  Patch: http://marc.info/?l=tomcat-dev&m=119245116910632&w=2
-  +1: markt, funkman, remm, fhanik
-  -1: 
-
 * Fix for JDT update: update jdt.jar in build.properties.default to:
   jdt.jar=${jdt.lib}/org.eclipse.jdt.core_3.3.1.v_780_R33x.jar
   +1: remm, fhanik,funkman, pero
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -158,6 +158,10 @@
       <fix>
         Fix WebDAV Servlet so it works correctly with MS clients. (markt)
       </fix>
+      <fix>
+        Fix CVE-2007-5461, an important information disclosure vulnerability in
+        the WebDAV Servlet. (markt)
+      </fix>
       <fix>
         <bug>42979</bug>: Update sample.war to include recent security fixes
         in the source code. (markt)
901292cf9d7d

Fix CVE-2007-5461.

https://github.com/apache/tomcatMark Emlyn David ThomasOct 18, 2007via ghsa
commit
3 files changed · +5 −5
  • java/org/apache/catalina/servlets/WebdavServlet.java+1 −0 modified
    @@ -243,6 +243,7 @@ protected DocumentBuilder getDocumentBuilder()
         try {
             documentBuilderFactory = DocumentBuilderFactory.newInstance();
             documentBuilderFactory.setNamespaceAware(true);
+            documentBuilderFactory.setExpandEntityReferences(false);
             documentBuilder = documentBuilderFactory.newDocumentBuilder();
         } catch(ParserConfigurationException e) {
             throw new ServletException
  • STATUS+0 −5 modified
    @@ -42,11 +42,6 @@ PATCHES PROPOSED TO BACKPORT:
   +1: fhanik,funkman
   -1: 
   
-* Fix important vulnerability when webdav is enabled for write
-  Patch: http://marc.info/?l=tomcat-dev&m=119245116910632&w=2
-  +1: markt, funkman, remm, fhanik
-  -1: 
-
 * Fix for JDT update: update jdt.jar in build.properties.default to:
   jdt.jar=${jdt.lib}/org.eclipse.jdt.core_3.3.1.v_780_R33x.jar
   +1: remm, fhanik,funkman, pero
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -158,6 +158,10 @@
       <fix>
         Fix WebDAV Servlet so it works correctly with MS clients. (markt)
       </fix>
+      <fix>
+        Fix CVE-2007-5461, an important information disclosure vulnerability in
+        the WebDAV Servlet. (markt)
+      </fix>
       <fix>
         <bug>42979</bug>: Update sample.war to include recent security fixes
         in the source code. (markt)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

84

News mentions

0

No linked articles in our index yet.