CVE-2025-49124
published 2025-06-16CVE-2025-49124: Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.34%
27.0th percentile
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | >= 10.1.0 < 10.1.42 | 10.1.42 |
| apache | tomcat | >= 11.0.0 < 11.0.8 | 11.0.8 |
| apache | tomcat | >= 9.0.23 < 9.0.106 | 9.0.106 |
| apache_software_foundation | apache_tomcat | 10.1.0 – 10.1.41 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.7 | — |
| apache_software_foundation | apache_tomcat | 7.0.95 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.44 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.23 – 9.0.105 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.4HIGH
vendor_debian8.4LOW
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Tomcat installer for Windows has an untrusted search path vulnerability
ghsa·2025-06-16
CVE-2025-49124 [MEDIUM] CWE-426 Apache Tomcat installer for Windows has an untrusted search path vulnerability
Apache Tomcat installer for Windows has an untrusted search path vulnerability
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
OSV
CVE-2025-49124: Untrusted Search Path vulnerability in Apache Tomcat installer for Windows
osv·2025-06-16·CVSS 8.4
CVE-2025-49124 [HIGH] CVE-2025-49124: Untrusted Search Path vulnerability in Apache Tomcat installer for Windows
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
OSV
Apache Tomcat installer for Windows has an untrusted search path vulnerability
osv·2025-06-16
CVE-2025-49124 [MEDIUM] Apache Tomcat installer for Windows has an untrusted search path vulnerability
Apache Tomcat installer for Windows has an untrusted search path vulnerability
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Microsoft
x86/mce: Work around an erratum on fast string copy instructions
vendor_msrc·2025-02-11·CVSS 5.5
CVE-2022-49124 [MEDIUM] x86/mce: Work around an erratum on fast string copy instructions
x86/mce: Work around an erratum on fast string copy instructions
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2025-49124: tomcat10 - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Duri...
vendor_debian·2025·CVSS 8.4
CVE-2025-49124 [HIGH] CVE-2025-49124: tomcat10 - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Duri...
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-16
Published