Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
https://github.com/advisories/GHSA-4gr9-99j3-vqxv
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1620