~ / search / GHSA-42wg-hm62-jcwg

GHSA-42wg-hm62-jcwg

Apache Tomcat installer for Windows has an untrusted search path vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-49124

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.8 11.0.8
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0, < 10.1.42 10.1.42
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.23, < 9.0.106 9.0.106
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.8 11.0.8
Maven org.apache.tomcat:tomcat >= 10.1.0, < 10.1.42 10.1.42
Maven org.apache.tomcat:tomcat >= 9.0.23, < 9.0.106 9.0.106
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.8 11.0.8
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0, < 10.1.42 10.1.42
Maven org.apache.tomcat:tomcat-catalina >= 9.0.23, < 9.0.106 9.0.106

Details

As written in the advisory (Markdown source, shown as plain text).

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

References

External links from the advisory. They lead to third-party sites.