EIP-2026-103853

This advisory describes a directory listing vulnerability in Apache Tomcat 5.x.x, where appending a semicolon to a mapped file extension forces the server to reveal directory contents. The vulnerability is confirmed in versions 5.0.28, 5.5.12, 5.5.9, and 5.5.7.