EUVD-2025-18410
GHSA-42wg-hm62-jcwg
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
- 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 11.0.0-M1 and other introduced versions.
DescriptionNVD
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
AnalysisAI
A security vulnerability in Apache Tomcat installer for Windows (CVSS 8.4). High severity vulnerability requiring prompt remediation.
Technical ContextAI
Vulnerability type not specified by vendor. CVSS 8.4 indicates high severity. Affects Apache Tomcat installer for Windows.
RemediationAI
Monitor vendor channels for patch availability.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| upstream | not-affected | debian: Windows-specific |
| oracular | ignored | end of life, was needs-triage |
| noble | not-affected | Windows-specific |
| plucky | not-affected | Windows-specific |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | not-affected | debian: Windows-specific |
| Release | Status | Version |
|---|---|---|
| upstream | not-affected | debian: Windows-specific |
| oracular | ignored | end of life, was needs-triage |
| bionic | not-affected | Windows-specific |
| focal | not-affected | Windows-specific |
| jammy | not-affected | Windows-specific |
| noble | not-affected | Windows-specific |
| plucky | not-affected | Windows-specific |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | fixed | 10.1.34-0+deb12u2 | - |
| bookworm (security) | fixed | 10.1.52-1~deb12u1 | - |
| trixie (security), trixie | fixed | 10.1.52-1~deb13u1 | - |
| forky, sid | fixed | 10.1.52-1 | - |
| (unstable) | not-affected | - | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| trixie (security), trixie | fixed | 11.0.15-1~deb13u1 | - |
| forky, sid | fixed | 11.0.18-1 | - |
| (unstable) | not-affected | - | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 9.0.43-2~deb11u10 | - |
| bullseye (security) | fixed | 9.0.107-0+deb11u2 | - |
| bookworm | fixed | 9.0.70-2 | - |
| trixie | fixed | 9.0.95-1 | - |
| forky, sid | fixed | 9.0.115-1 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today