CVE-2025-49124 — Vulnerability in...

MEDIUM

Apache Tomcat installer for Windows has an untrusted search path vulnerability

Published June 16, 2025Updated October 29, 2025Source: osv

Summary

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Advisory Timeline

First published June 16, 2025 (483 days ago).
Last revised October 29, 2025 — 135 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.apache.tomcat:tomcat-catalina to 11.0.8 or later

<!-- Update pom.xml dependency version to 11.0.8 for org.apache.tomcat:tomcat-catalina -->

Maven

Update org.apache.tomcat:tomcat-catalina to 10.1.42 or later

<!-- Update pom.xml dependency version to 10.1.42 for org.apache.tomcat:tomcat-catalina -->

Maven

Update org.apache.tomcat:tomcat to 11.0.8 or later

<!-- Update pom.xml dependency version to 11.0.8 for org.apache.tomcat:tomcat -->

Maven

Update org.apache.tomcat.embed:tomcat-embed-core to 10.1.42 or later

<!-- Update pom.xml dependency version to 10.1.42 for org.apache.tomcat.embed:tomcat-embed-core -->

Maven

Update org.apache.tomcat:tomcat-catalina to 9.0.106 or later

<!-- Update pom.xml dependency version to 9.0.106 for org.apache.tomcat:tomcat-catalina -->

Maven

Update org.apache.tomcat:tomcat to 9.0.106 or later

<!-- Update pom.xml dependency version to 9.0.106 for org.apache.tomcat:tomcat -->

Maven

Update org.apache.tomcat.embed:tomcat-embed-core to 11.0.8 or later

<!-- Update pom.xml dependency version to 11.0.8 for org.apache.tomcat.embed:tomcat-embed-core -->

Maven

Update org.apache.tomcat.embed:tomcat-embed-core to 9.0.106 or later

<!-- Update pom.xml dependency version to 9.0.106 for org.apache.tomcat.embed:tomcat-embed-core -->

Maven

Update org.apache.tomcat:tomcat to 10.1.42 or later

<!-- Update pom.xml dependency version to 10.1.42 for org.apache.tomcat:tomcat -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (9)

Affects 1 ecosystem: maven (3).

Package	Ecosystem	Affected	Fixed In
org.apache.tomcat:tomcat-catalina	maven	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+27 more)	11.0.8
org.apache.tomcat:tomcat-catalina	maven	10.1.0, 10.1.1, 10.1.10, 10.1.11 (+31 more)	10.1.42
org.apache.tomcat:tomcat	maven	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+27 more)	11.0.8
org.apache.tomcat.embed:tomcat-embed-core	maven	10.1.0, 10.1.1, 10.1.10, 10.1.11 (+31 more)	10.1.42
org.apache.tomcat:tomcat-catalina	maven	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+64 more)	9.0.106
org.apache.tomcat:tomcat	maven	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+64 more)	9.0.106
org.apache.tomcat.embed:tomcat-embed-core	maven	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+27 more)	11.0.8
org.apache.tomcat.embed:tomcat-embed-core	maven	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+64 more)	9.0.106
org.apache.tomcat:tomcat	maven	10.1.0, 10.1.1, 10.1.10, 10.1.11 (+31 more)	10.1.42

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-426
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.1 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

Frequently Asked Questions

What is CVE-2025-49124?: Apache Tomcat installer for Windows has an untrusted search path vulnerability This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.1/10).
How do I check if my project is affected by CVE-2025-49124?: CVE-2025-49124 affects org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat and org.apache.tomcat.embed:tomcat-embed-core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-49124 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-42wg-hm62-jcwg

BIT-tomcat-2025-49124

Related CVEs

CVE-2026-43515
CRITICAL
Apache Tomcat - Security constraints not correctly applied
CVE-2026-65905
CRITICAL
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
CVE-2026-65182
CRITICAL
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
CVE-2026-68525
CRITICAL
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
CVE-2026-43512
CRITICAL
Apache Tomcat - Digest authenticator will authenticate any unknown user
CVE-2026-43513
HIGH
Apache Tomcat: LockOutRealm treats user names as case-sensitive
CVE-2026-42498
HIGH
Apache Tomcat - WebSocket authentication header exposure
CVE-2026-41284
HIGH
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies