PT-2025-25562 · Apache · Apache Tomcat

T. Doğa Gelişli · Published 2025-06-09 · Updated 2026-04-28 · CVE-2025-49124

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.7 Apache Tomcat versions 10.1.0 through 10.1.41 Apache Tomcat versions 9.0.23 through 9.0.105

Description The issue is related to an Untrusted Search Path vulnerability in the Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

Recommendations For Apache Tomcat versions 11.0.0-M1 through 11.0.7, upgrade to version 11.0.8. For Apache Tomcat versions 10.1.0 through 10.1.41, upgrade to version 10.1.42. For Apache Tomcat versions 9.0.23 through 9.0.105, upgrade to version 9.0.106.

Fix

DoS

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2025-08201

BIT-TOMCAT-2025-49124

CVE-2025-49124

GHSA-42WG-HM62-JCWG

Affected Products

Apache Tomcat

References · 33

• https://nvd.nist.gov/vuln/detail/CVE-2025-49124 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49124 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08201 · Security Note
• https://osv.dev/vulnerability/BIT-tomcat-2025-49124 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2025-49124 · Vendor Advisory
• https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-42wg-hm62-jcwg · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49124 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49124 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49124 · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7 · Note
• https://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823 · Note
• https://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49 · Note
• https://twitter.com/the_yellow_fall/status/1934799023027966258 · Twitter Post