Read the docs
TI-2025-31205 Aliases CVE-2025-49124GHSA-42wg-hm62-jcwg

Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

Priority LOW 38CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-426.

Summary

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat.embed:tomcat-embed-core (Maven): 11.0.8, 10.1.42, 9.0.106org.apache.tomcat:tomcat (Maven): 11.0.8, 10.1.42, 9.0.106+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat11.0.0-M1 – 11.0.7; 10.1.0 – 10.1.41; 9.0.23 – 9.0.105; 8.5.44 – 8.5.100; 7.0.95 – 7.0.109—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)11.0.0-M1 to before 11.0.811.0.8Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat.embed:tomcat-embed-core (Maven)10.1.0 to before 10.1.4210.1.42Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.23 to before 9.0.1069.0.106Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat (Maven)11.0.0-M1 to before 11.0.811.0.8Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat (Maven)10.1.0 to before 10.1.4210.1.42Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat (Maven)9.0.23 to before 9.0.1069.0.106Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat-catalina (Maven)11.0.0-M1 to before 11.0.811.0.8Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat-catalina (Maven)10.1.0 to before 10.1.4210.1.42Patch availableGHSA-42wg-hm62-jcwg
—org.apache.tomcat:tomcat-catalina (Maven)9.0.23 to before 9.0.1069.0.106Patch availableGHSA-42wg-hm62-jcwg
  • Apache Tomcat VendorApache Affected 11.0.0-M1 – 11.0.7; 10.1.0 – 10.1.41; 9.0.23 – 9.0.105; 8.5.44 – 8.5.100; 7.0.95 – 7.0.109 Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.8 Fixed in 11.0.8 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.0 to before 10.1.42 Fixed in 10.1.42 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.23 to before 9.0.106 Fixed in 9.0.106 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.8 Fixed in 11.0.8 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.1.0 to before 10.1.42 Fixed in 10.1.42 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.23 to before 9.0.106 Fixed in 9.0.106 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.8 Fixed in 11.0.8 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0 to before 10.1.42 Fixed in 10.1.42 Patch available GHSA-42wg-hm62-jcwg
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.23 to before 9.0.106 Fixed in 9.0.106 Patch available GHSA-42wg-hm62-jcwg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*9.0.23 to before 9.0.106; 10.1.0 to before 10.1.42; 11.0.0 to before 11.0.8VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 9.0.23 to before 9.0.106; 10.1.0 to before 10.1.42; 11.0.0 to before 11.0.8 Vulnerable ·Apache

Remediation

  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 11.0.8 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.42 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.106 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat (Maven) Fixed in 11.0.8 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat (Maven) Fixed in 10.1.42 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat (Maven) Fixed in 9.0.106 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat-catalina (Maven) Fixed in 11.0.8 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.42 Advisory →
  • Fix · GHSA-42wg-hm62-jcwg org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.106 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49124
  2. 2026-10-03 Alias added: GHSA-42wg-hm62-jcwg

References

Advisory 3

Other 7

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences