GHSA-m8h8-6rvg-f4mg Apache Tomcat Path Traversal Vulnerability

• Maven org.apache.tomcat:tomcat: >= 4.1.0, < 4.1.38 → fixed in 4.1.38 • Maven org.apache.tomcat:tomcat: >= 5.5.0, < 5.5.27 → fixed in 5.5.27 • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.18 → fixed in 6.0.18

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a `RequestDispatcher` is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a `..` (dot dot) in a request parameter.