CVE-2007-0450: Apache HTTP Server and Tomcat proxy directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read with a very high EPSS score, though the CVSS v2 base is only 5.0 and no KEV listing exists.

What it is

Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10 mishandle path separators when proxy modules (mod_proxy, mod_rewrite, mod_jk) are in use. Tomcat treats slash, backslash and URL-encoded backslash as valid separators while Apache does not, so a crafted .. sequence can escape the intended path. This lets a remote unauthenticated attacker read files outside the web root on affected deployments.

Impact

An attacker can read arbitrary files reachable by the server process, exposing configuration, credentials or source code. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to a server using the affected proxy modules; no authentication or user interaction is required (AV:N/AC:L/Au:N). Exploitation depends on the proxy configuration being present.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.90768, 99.8th percentile), indicating strong predicted likelihood, but the references carry only advisory and vendor tags, so no confirmed in-the-wild exploitation is stated.

What to do

• Upgrade Tomcat to 5.5.22 or 6.0.10 or later, and apply the corresponding Apache HTTP Server fix.
• If patching is delayed, disable or restrict mod_proxy, mod_rewrite and mod_jk where they are not required.
• Normalize and reject requests containing backslash or encoded backslash (%5C) and .. sequences at the proxy layer.
• Run the web/proxy service with least privilege and restrict filesystem access to only needed paths.
• Review proxy and rewrite rules for unsafe path forwarding to Tomcat.

Detection

• Search web and proxy logs for URLs containing .. combined with backslash or %5C.
• Alert on requests to proxy endpoints that resolve outside the expected document root.
• Monitor for anomalous reads of sensitive files (configuration, credential stores) by the web server process.
• Baseline normal proxy request patterns and flag deviations in separator encoding.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.