The issue is related to a directory traversal vulnerability in the RequestUtil.java file. This vulnerability allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call. The vulnerability can be exploited by using the "/.." symbols in the path name, which can allow an attacker to obtain a directory listing for the directory in which the web application had been deployed, typically $CATALINA BASE/webapps. This should not be possible when running under a security manager.