Untrusted Search Path Vulnerability in Apache Tomcat Installer for Windows
CVE-2025-49124

8.4HIGH

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
16 June 2025

What is CVE-2025-49124?

An untrusted search path vulnerability has been identified in the Apache Tomcat installer for Windows. During installation, the Tomcat installer utilizes the icacls.exe component without specifying its full path, potentially exposing the system to security risks. This affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.7, 10.1.0 through 10.1.41, and 9.0.23 through 9.0.105. To address this flaw, users are strongly advised to upgrade to the latest versions—11.0.8, 10.1.42, or 9.0.106—which include the necessary fixes.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.7

Apache Tomcat 10.1.0 <= 10.1.41

Apache Tomcat 9.0.23 <= 9.0.105

References

https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6...
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

T. DoÄźa GeliĹźli https://linkedin.com/in/tdogagelisli/
.
CVE-2025-49124 : Untrusted Search Path Vulnerability in Apache Tomcat Installer for Windows