CVE-2025-49124HIGH 8.4EPSS p26.4%

CVE-2025-49124CVE-2025-49124

Description

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Scoring

CVSS 3.18.4 (HIGH)
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.35% probability of exploitation · percentile 26.4% · 2026-06-19T12:03:05Z
Published2025-06-16
Last modified2025-10-29

Underlying weaknesses· 1

CWE-426

References

  1. https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
  2. http://www.openwall.com/lists/oss-security/2025/06/16/3

1

TypeTargetConfidenceTier
WeaknessUntrusted Search Pathcwe-4260%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-41293
CVE
CVE-2025-55754
CVE
CVE-2025-31651
CVE
CVE-2026-43512
CVE
CVE-2026-43515
CVE
CVE-2025-66614
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.