What breaks when Tomcat path traversal is not controlled?

When Tomcat normalisation and decoding do not align with access controls, attackers may reach restricted directories that should never be exposed. If the deployment also allows HTTP PUT or writable upload paths, the issue can move from directory access to file placement and potential remote code execution. The failure is configuration and governance, not just patch delay.

Why This Matters for Security Teams

Tomcat path traversal is not just a bad URL problem. It becomes a control failure when request decoding, path normalisation, and file system authorization do not agree on what is actually being requested. That mismatch can let an attacker reach configuration files, application resources, or writable directories that were assumed to be out of reach. In environments that still allow HTTP PUT or broad upload permissions, the impact can move from disclosure to file placement and, in some cases, code execution. This is why the issue belongs in governance, not only patch management. NHI Management Group’s Ultimate Guide to NHIs shows that 73% of vaults are misconfigured, a reminder that access failures usually come from weak controls around runtime paths, secrets, and permissions rather than a single bug. NIST’s Cybersecurity Framework 2.0 treats this as a protect-and-detect problem, not a one-time hardening task. In practice, many security teams only discover Tomcat traversal exposure after logs show access to directories that should never have been reachable.

How It Works in Practice

The failure usually begins when Tomcat, the reverse proxy, and the application each interpret paths differently. One component may decode an encoded slash, collapse dot segments, or strip matrix parameters, while another component evaluates the path after a different transformation. If access control checks happen before the final normalised path is resolved, the request can pass policy but still land in a restricted location. That is why “it was filtered” is not the same as “it was blocked.” Current guidance suggests treating URL handling as a trust boundary and testing the full request path from edge to application, including proxy rewrites, servlet mappings, and filesystem permissions.

Practically, teams should verify all of the following:

• Tomcat and upstream proxies normalise paths consistently.
• Restricted directories are denied by filesystem and application policy, not by obscurity.
• HTTP PUT is disabled unless explicitly required and tightly scoped.
• Upload locations are non-executable and separated from application code.
• Secrets, config files, and deployment artifacts are not stored in web-accessible paths.

The control objective is not only to stop traversal, but to prevent a traversed path from becoming a privilege boundary bypass. NHI Management Group’s Schneider Electric credentials breach and GitHub Personal Account Breach both reinforce a broader lesson: once an attacker reaches configuration or token material, the blast radius expands fast. These controls tend to break down when legacy Tomcat deployments sit behind mixed proxy chains because each layer rewrites paths differently and no single layer owns the final authorization decision.

Common Variations and Edge Cases

Tighter path controls often increase operational overhead, requiring organisations to balance safer defaults against legacy application compatibility. The hardest cases are older Java applications that rely on loose servlet mappings, embedded upload features, or shared directories for reports and assets. In those environments, there is no universal standard for this yet, but best practice is evolving toward explicit allowlists, non-executable storage, and request-time validation that uses the final canonical path rather than the raw URI.

Edge cases also appear when teams assume traversal is only a disclosure issue. If a writable directory is reachable, an attacker may place a JSP, modify a deployment artifact, or overwrite a file that later gets executed by a separate process. That is why HTTP PUT deserves special scrutiny: it may be harmless in one service and catastrophic in another. The safest approach is to separate web content from writable storage, remove unnecessary file write methods, and review permissions for service accounts that touch the Tomcat runtime. NHI risks grow quickly when file access and identity controls are left implicit, which aligns with the broader warning in the Ultimate Guide to NHIs — Standards that governance must cover lifecycle, privilege, and exposure. These conditions are especially fragile in containerised or shared-host Tomcat deployments because a single writable mount can turn a traversal bug into persistent compromise.

Related resources from NHI Mgmt Group

• What breaks when a malicious Python package uses startup hooks instead of a normal import path?
• What breaks when a Kubernetes storage backend trusts user-controlled path templates?
• What breaks when a container download endpoint allows path traversal?
• What breaks when fake CAPTCHA attacks rely on the user to execute the payload?