Apache Tomcat 5.5.30 and 6.0.30 were released [1],[2] to fix, among other things, a bypass of security manager file permissions.  The work directory that web applications are granted read/write access is determined by a ServletContext attribute that is supposed to be a read-only attribute to web applications.  Due to a coding error, a web application could modify the attribute before Tomcat applied file permissions, which could allow a malicious web application to set the work directory to any area of the file system, granting that web application read/write permissions to the specified directory.

This vulnerability is only applicable in environments that host web applications from untrusted sources, such as in shared hosting environments.

For Tomcat 5.5.x, this was fixed in upstream revision 1027610 [4] and for Tomcat 6.x it was fixed in upstream revision 1022560 [5].

[1] http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.30
[2] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30
[3] http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0074.html
[4] http://svn.apache.org/viewvc?rev=1027610&view=rev
[5] http://svn.apache.org/viewvc?rev=1022560&view=rev