Apache Tomcat installer for Windows has an untrusted search path vulnerability

🗓️ 16 Jun 2025 15:32:28Reported by GitHub Advisory DatabaseType

Windows Tomcat installer has untrusted search path due to icacls usage; upgrade to 11.0.8, 10.1.42, or 9.0.106.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
Circl	CVE-2025-49124	16 Jun 202514:38	–	circl
CNNVD	Apache Tomcat 安全漏洞	16 Jun 202500:00	–	cnnvd
CVE	CVE-2025-49124	16 Jun 202514:22	–	cve
Cvelist	CVE-2025-49124 Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows	16 Jun 202514:22	–	cvelist
Debian CVE	CVE-2025-49124	16 Jun 202514:22	–	debiancve
EUVD	EUVD-2025-18410	3 Oct 202520:07	–	euvd
Hewlett-Packard	HP Device Manager Vulnerability Update (5.0.15)	2 Jul 202500:00	–	hp
Kaspersky	KLA84848 Multiple vulnerabilities in Apache Tomcat	10 Jun 202500:00	–	kaspersky
NCSC	Vulnerabilities fixed in Apache Tomcat	18 Jun 202508:01	–	ncsc

Vulners

Node

org.apache.tomcat tomcatRange9.0.23–9.0.106maven

org.apache.tomcat tomcatRange10.1.0–10.1.42maven

org.apache.tomcat tomcatRange11.0.0-M1–11.0.8maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-49124
lists	www.lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
openwall	www.openwall.com/lists/oss-security/2025/06/16/3
github	www.github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823
github	www.github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7
github	www.github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-42wg-hm62-jcwg

29 Oct 2025 16:05Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.4

EPSS0.00175

SSVC