GitHub Advisoryadvisory · Maven

GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability

MEDIUM Published 2025-06-16 Modified 2025-10-29 Official page ↗
Aliases
CVE-2025-49124
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-426
Reviewed
2025-10-29

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M1, < 11.0.8 → fixed in 11.0.8 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0, < 10.1.42 → fixed in 10.1.42 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.23, < 9.0.106 → fixed in 9.0.106 • Maven org.apache.tomcat:tomcat: >= 11.0.0-M1, < 11.0.8 → fixed in 11.0.8 • Maven org.apache.tomcat:tomcat: >= 10.1.0, < 10.1.42 → fixed in 10.1.42 • Maven org.apache.tomcat:tomcat: >= 9.0.23, < 9.0.106 → fixed in 9.0.106 • Maven org.apache.tomcat:tomcat-catalina: >= 11.0.0-M1, < 11.0.8 → fixed in 11.0.8 • Maven org.apache.tomcat:tomcat-catalina: >= 10.1.0, < 10.1.42 → fixed in 10.1.42 • Maven org.apache.tomcat:tomcat-catalina: >= 9.0.23, < 9.0.106 → fixed in 9.0.106

Description

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Related

Alias · CVE (1)

  • CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References