CVE-2025-49124: Apache Tomcat Installer for Windows Untrusted Search Path Vulnerability
Summary
CVE-2025-49124: Apache Tomcat installer for Windows has an untrusted search path vulnerability. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
>= 9.0.23, < 9.0.106
>= 10.1.0, < 10.1.42
>= 11.0.0-M1, < 11.0.8
Fixed in 9.0.106, 10.1.42 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2025-49124 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The Tomcat installer for Windows is designed to simplify the installation process, but it has been found to have a security flaw that could potentially allow malicious actors to exploit the installation process.
Vulnerability Detail
The vulnerability arises from an untrusted search path in the Apache Tomcat installer for Windows. During installation, the installer uses the 'icacls.exe' command without specifying a full path, which could allow an attacker to place a malicious version of 'icacls.exe' in a directory that is searched before the legitimate one. This could lead to privilege escalation or execution of arbitrary code during the installation process, compromising the security of the system.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.23, < 9.0.1069.0.106 -
>= 10.1.0, < 10.1.4210.1.42 -
>= 11.0.0-M1, < 11.0.811.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can ensure that the installation directory is secure and that no untrusted files are present in the search path. However, this is not a permanent solution and upgrading to the fixed versions is strongly recommended.
Conclusion
The untrusted search path vulnerability in the Apache Tomcat installer for Windows poses a moderate risk to users. It is crucial to upgrade to the patched versions to mitigate potential security threats. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
CVE-2025-49124 is a vulnerability in the Apache Tomcat installer for Windows that allows for an untrusted search path, potentially leading to privilege escalation.
The affected versions are Apache Tomcat from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, and from 9.0.23 through 9.0.105.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by using the Vulert playground without any signup.
If you cannot upgrade immediately, ensure that your installation directory is secure and monitor for any suspicious files that could exploit this vulnerability.
More information can be found in the official Apache Tomcat security advisory and on platforms like GitHub where the vulnerability is documented.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
