PT-2025-45666 · Maven · Org.Apache.Tomcat.Embed:Tomcat-Embed-Core+2

Published 2025-06-16 · Updated 2025-06-16

OSV

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

GHSA-42WG-HM62-JCWG

Affected Products

Org.Apache.Tomcat.Embed:Tomcat-Embed-Core

Org.Apache.Tomcat:Tomcat

Org.Apache.Tomcat:Tomcat-Catalina

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-49124 · Security Note
• https://osv.dev/vulnerability/GHSA-42wg-hm62-jcwg · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823 · Note
• https://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49 · Note
• https://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7 · Note
• http://openwall.com/lists/oss-security/2025/06/16/3 · Note
• https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv · Note
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106 · Note
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8 · Note
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42 · Note