Apache Tomcat up to 9.0.105/10.1.41/11.0.7 on Windows Installer icacls.exe untrusted search path

Summaryinfo

A vulnerability, which was classified as problematic, was found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 on Windows. Affected by this vulnerability is an unknown functionality of the file icacls.exe of the component Installer. Executing a manipulation can lead to untrusted search path. The identification of this vulnerability is CVE-2025-49124. The attack can only be executed locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 on Windows and classified as critical. This vulnerability affects some unknown functionality of the file icacls.exe of the component Installer. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

The weakness was shared by T. Doğa Gelişli. The advisory is shared for download at lists.apache.org. This vulnerability was named CVE-2025-49124 since 06/02/2025. The exploitation appears to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/22/2025). The MITRE ATT&CK project declares the attack technique as T1574.

The vulnerability scanner Nessus provides a plugin with the ID 240060 (Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240060), EUVD (EUVD-2025-18410) and CERT Bund (WID-SEC-2025-1335). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• Xerox FreeFlow Print Server
• Hitachi Ops Center
• Apache Tomcat
• Atlassian Jira
• Absolute Secure Access
• Red Hat JBoss Web Server
• Open Source Camunda
• Dell PowerProtect Data Domain
• HCL Commerce
• IBM Integration Bus
• Atlassian Bitbucket
• SAS Institute Base SAS
• Dell Secure Connect Gateway
• Dell NetWorker

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 9.0.105
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion