CVE-2025-49124CWE-426

Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

High · published June 16, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

The following versions were EOL at the time the CVE was created but are

known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.9th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-06-16T14:22Z
EPSS history
Timeline
  • 16 JUN 14:22Z
    Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
    cvelistv5