The description for allowLinking is inaccurate on this page: https://tomcat.apache.org/tomcat-8.0-doc/config/resources.html#Attributes "If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false." This makes an assumption that symlinks to resources *inside* the web application base path should work, regardless of this flag. However, they do not. NO symlinks work unless the allowLinking flag is set, whether they fall inside our outside the application base path.
Thanks for the report. Fixed in: - trunk for 9.0.3 onwards - 8.5.x for 8.5.25 onwards - 8.0.x for 8.0.49 onwards - 7.0.x for 7.0.84 onwards Note that allowLinking is an attribute on the Context element in 7.0.x.