CVE-2006-3835: Apache Tomcat directory listing via semicolon-prefixed mapped filenames

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw is an unauthenticated information disclosure with public exploit details and high EPSS, but it only leaks directory contents and has no integrity or availability impact.

What it is

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories by placing a semicolon before a filename with a mapped extension, such as /;index.jsp or /;help.do. The flaw exposes directory contents that should not be browsable, leaking file and path information useful for reconnaissance. It affects confidentiality only, with no integrity or availability impact.

Impact

An unauthenticated attacker gains directory listing output, revealing file and directory names on the server. This information disclosure can support follow-on targeting of exposed resources.

Attack surface

Reachable over the network via HTTP requests to the Tomcat web server; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. The crafted URL uses a semicolon before a mapped extension to trigger the listing.

Exploitation

Not listed in CISA KEV, but EPSS is 0.46207 (98.8th percentile) and public references are tagged Exploit, indicating exploit code and details are publicly available. No ransomware usage is documented.

What to do

• Upgrade Apache Tomcat 5 to 5.5.17 or later, or apply the vendor patch referenced in the Tomcat security pages.
• Disable directory listings in the Tomcat default servlet and web application configuration.
• Restrict or block requests containing semicolon path segments at the reverse proxy or WAF where feasible.
• Review deployed Tomcat versions across the estate and prioritize internet-facing instances for upgrade.

Detection

• Search web access logs for request URIs containing a semicolon immediately before a mapped extension, such as /;index.jsp or /;help.do.
• Alert on responses returning directory listing content or unexpected 200 responses to semicolon-prefixed paths.
• Monitor for scanning patterns that enumerate semicolon-prefixed filenames across multiple directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.