In the late 2000s, I worked for an enterprise software company. Turns out many smaller customers that needed our software were Windows based and ran our Tomcat based software on Windows servers. The larger companies that had dedicated Unix clusters for our software and other things.
In the world of SaaS, this becomes less of a thing, but there are still a lot non-tech small businesses that start with Windows based IT solutions because they want Office & Outlook. Then they find some domain specific thing that they want to host and since they know windows, it runs on a Windows server.
should be very unlikely. Unfortunately, there's a lot of this sort of thing. It's especially popular with enterprise software, which will often be a Windows exe or msi that wraps Tomcat and a Java app.
It looks like they are using getCanonicalPath to ensure that the file is under the serving root but there is some behavior that confused the Tomcat code. I can imagine this bug could manifest in other software that depends on this behavior on Windows.
