CVE-2025-49124

Description

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Reserved 2025-06-02 | Published 2025-06-16 | Updated 2025-06-16 | Assigner apache

Problem types

CWE-426 Untrusted Search Path

Product status

Default status
unaffected

11.0.0-M1
affected

10.1.0
affected

9.0.23
affected

Credits

T. Doğa Gelişli https://linkedin.com/in/tdogagelisli/ finder

References

lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv vendor-advisory

cve.org (CVE-2025-49124)

nvd.nist.gov (CVE-2025-49124)

Download JSON