CVE catalog

CVE-2025-49124

tomcat10 affected and fixed versions

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Severity: Low
Published: Jun 16, 2025, 3:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 27, 2026

Projects and upstream resources

[tomcat10][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "tomcat9",
      "status": "not affected",
      "release": "sid",
      "version": "9.0.122-1"
    },
    {
      "name": "tomcat9",
      "status": "not affected",
      "release": "forky",
      "version": "9.0.122-1"
    },
    {
      "name": "tomcat9",
      "status": "not affected",
      "release": "trixie",
      "version": "9.0.95-1"
    },
    {
      "name": "tomcat9",
      "status": "not affected",
      "release": "bookworm",
      "version": "9.0.70-2"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "sid",
      "version": "10.1.60-1"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "forky",
      "version": "10.1.60-1"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "trixie",
      "version": "10.1.55-1~deb13u1"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "trixie-security",
      "version": "10.1.55-1~deb13u1"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "bookworm",
      "version": "10.1.55-1~deb12u1"
    },
    {
      "name": "tomcat10",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "10.1.55-1~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "tomcat9",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat9",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat9",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat9",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat10",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat10",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat10",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "tomcat10",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libtomcat10-embed-java]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[libtomcat10-java]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[libtomcat9-java]Unknown
Source package: [tomcat9]
Details (2)
- 9.0.70-2 · all · bookworm
  Not affected
  dsa · tomcat9 · debian · bookworm
- 9.0.70-2 · all · bookworm
  Not affected
  dsa · tomcat9 · debian · bookworm
[tomcat10]Unknown
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[tomcat10-admin]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[tomcat10-common]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[tomcat10-docs]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[tomcat10-examples]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
[tomcat10-user]Unknown
Source package: [tomcat10]
Details (6)
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.40-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm
- 10.1.55-1~deb12u1 · all · bookworm-security
  Not affected
  dsa · tomcat10 · debian · bookworm

Observed: Oct 27, 2026, 1:44:30 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]