What is the CVSS score of CVE-2025-49125?

CVE-2025-49125 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2025-49125?

Within 24 hours: Inventory all Tomcat instances and identify those running versions 9.0.0-9.0.105, 10.1.0-10.1.41, or 11.0.0-11.0.7; disable PreResources and PostResources features if not critical to operations. Within 7 days: Apply vendor patches (upgrade to 9.0.106, 10.1.42, or 11.0.8) to all affected systems in development and staging environments; conduct security testing post-patch. Within 30 days: Complete patching of all production Tomcat instances and validate no unauthorized access has occurred through log analysis.

Tomcat CVE-2025-49125

EUVD-2025-18406 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2025-06-16 security@apache.org

GHSA-wc4r-xq3c-5cf3

Authentication Bypass Apache Java Red Hat Tomcat Suse

High

Disputed · 7.5 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-288 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Alternate path authentication
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates this is a highly exploitable vulnerability: network-accessible with low attack complexity, requiring no privileges or user interaction, and affecting the confidentiality of protected resources. The vulnerability is unauthenticated (PR:N), making it immediately exploitable by any remote attacker. While integrity and availability are not directly impacted (I:N/A:N), the high confidentiality impact (C:H) indicates potential exposure of sensitive data stored in protected resources. The attack vector being network-based and attack complexity being low suggests this vulnerability has high real-world exploitability. Without access to EPSS score or KEV status in provided data, the authentication bypass nature combined with network accessibility and zero prerequisites strongly indicates active exploitation likelihood is high. Organizations running affected Tomcat versions with PreResources/PostResources configurations are at elevated risk, particularly if those resources contain sensitive information.
Exploit ScenarioDerived	An attacker targeting a Tomcat instance serving a web application with protected resources mounted via PostResources at path '/secure/data' (mounted outside the application root) observes that the web.xml security constraint requires authentication for '/secure/*' paths. The attacker crafts a request using path normalization techniques (e.g., '/secure/..;/data' or similar URL encoding/canonicalization bypass) to access the resource through an alternate path that the security constraint filter does not match, thus bypassing authentication. The attacker successfully retrieves sensitive data (database backups, configuration files, user records) stored in the mounted resource without providing credentials. This is a network-based attack requiring no authentication, making it immediately actionable upon discovering a vulnerable Tomcat instance. No user interaction is required, and the attack is reliable given the low attack complexity rating.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

CVE-2025-49125 is an authentication bypass vulnerability in Apache Tomcat affecting versions 8.5.0-8.5.100, 9.0.0-9.0.105, 10.1.0-10.1.41, and 11.0.0-11.0.7. The vulnerability allows unauthenticated remote attackers to access PreResources or PostResources mounted outside the web application root via alternate path traversal, bypassing security constraints configured for the intended resource path. With a CVSS score of 7.5 and high confidentiality impact, this represents a critical authentication mechanism failure that requires immediate patching.

RemediationAI

Immediate actions: (1) Upgrade to Apache Tomcat 11.0.8, 10.1.42, or 9.0.106 or later versions which contain the fix for path canonicalization in resource mounting. (2) For EOL version 8.5.x, upgrade to a supported version as no patch will be provided for unsupported branches. (3) Interim mitigation (if patching cannot be immediately completed): disable PreResources and PostResources configurations if not critical to operations, or restrict access to these resource paths through external firewall/reverse proxy rules that enforce additional authentication before Tomcat processing. (4) Review and strengthen security constraints in web.xml for any resources served through alternate paths. (5) Implement request logging and monitoring to detect exploitation attempts targeting unusual resource paths. Patch availability: Vendor patches are available as of the CVE publication date for versions 9.0.106, 10.1.42, and 11.0.8 from the Apache Tomcat project repository.

Affected VersionsENISA

Apache Tomcat 11.0.0-M1 ≤11.0.7

Apache Tomcat 9.0.0.M1 ≤9.0.105

Apache Tomcat 8.5.0 ≤8.5.100

Apache Tomcat 10.1.0-M1 ≤10.1.41

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 9.0.106, 10.1.42, 11.0.8

maven org.apache.tomcat:tomcat-catalina fix: 9.0.106, 10.1.42, 11.0.8

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Apache Tomcat's resource mounting feature (PreResources and PostResources) is used to serve static or dynamic content from locations outside the primary web application directory. When these resources are mounted at non-root paths, Tomcat's security constraint enforcement relies on path-based access control. The vulnerability stems from CWE-288 (Authentication Using an Alternate Path or Channel), where insufficient validation of resource path normalization allows attackers to construct requests that access protected resources through alternate URL paths that bypass the configured security constraints. The root cause involves improper canonicalization of request paths before applying security filters and authentication checks, enabling path traversal techniques to circumvent the intended protection mechanisms.

Know when Tomcat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Ubuntu MEDIUM

SUSE HIGH

Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jun 16, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.0.0-M1 and other introduced versions.

Executive ViewAI

Why It Matters

A critical authentication bypass vulnerability in Apache Tomcat allows attackers to access protected resources through alternate paths, potentially exposing sensitive data and enabling unauthorized actions. Organizations running affected Tomcat versions (9.x, 10.x, 11.x) face immediate risk of unauthorized access to web application resources, regardless of configured security constraints.

Business Impact: High

Compensating Controls

Until patches are available: (1) Disable PreResources and PostResources mounting features if operationally feasible; (2) Implement Web Application Firewall (WAF) rules to block requests containing suspicious path traversal patterns to resource directories; (3) Segment Tomcat instances with network controls to limit exposure; (4) Review and strengthen authentication/authorization logging to detect exploitation attempts; (5) Apply strict HTTP request filtering at reverse proxy or load balancer to restrict access patterns.

Threat Intelligence Overview

EPSS Score

0.2%

Top 65% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Tomcat

View all

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2020-1938 CRITICAL Act Now POC

9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate

CVE-2023-47246 CRITICAL Emergency POC

9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2017-12615 HIGH Act Now POC

8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-0050 HIGH Act Now POC

7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,

CVE-2020-13935 HIGH Act Now POC

7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to

CVE-2018-11784 MEDIUM This Month POC

4.3 Oct 04

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r

CVE-2022-29885 HIGH Act Now POC

7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH Act Now

7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH Act Now POC

7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

Same weakness CWE-288 – Authentication Bypass Using an Alternate Path or Channel

View all

CVE-2024-1709 CRITICAL POC

10.0

CVE-2020-10148 CRITICAL POC

9.8

CVE-2024-55591 CRITICAL POC

9.8

CVE-2025-2747 CRITICAL POC

9.8

CVE-2025-2746 CRITICAL POC

9.8

CVE-2025-4427 MEDIUM POC

5.3

CVE-2025-34026 CRITICAL POC

9.2

CVE-2026-23760 CRITICAL POC

9.3

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

Ubuntu

Priority: Medium

tomcat10

Release	Status	Version
jammy	DNE	-
noble	needed	-
upstream	released	10.1.42
plucky	ignored	end of life, was needed
oracular	ignored	end of life, was needs-triage
questing	needed	-

tomcat11

Release	Status	Version
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
upstream	released	11.0.8
questing	needed	-

tomcat9

Release	Status	Version
noble	not-affected	9.0.70-2ubuntu0.1
oracular	not-affected	-
plucky	not-affected	-
upstream	released	9.0.70-2
bionic	needed	-
focal	needed	-
jammy	needed	-
questing	not-affected	-

Debian

Bug #1108115

tomcat10

Release	Status	Fixed Version	Urgency
bookworm	fixed	10.1.52-1~deb12u1	-
bookworm (security)	fixed	10.1.52-1~deb12u1	-
trixie (security), trixie	fixed	10.1.52-1~deb13u1	-
forky, sid	fixed	10.1.52-1	-
trixie	fixed	10.1.52-1~deb13u1	-
(unstable)	fixed	10.1.46-1	-

tomcat11

Release	Status	Fixed Version	Urgency
trixie (security), trixie	fixed	11.0.15-1~deb13u1	-
forky, sid	fixed	11.0.18-1	-
trixie	fixed	11.0.15-1~deb13u1	-
(unstable)	fixed	11.0.11-1	-

tomcat9

Release	Status	Fixed Version	Urgency
bullseye	fixed	9.0.107-0+deb11u1	-
bullseye (security)	fixed	9.0.107-0+deb11u2	-
bookworm	fixed	9.0.70-2	-
trixie	fixed	9.0.95-1	-
forky, sid	fixed	9.0.115-1	-
(unstable)	fixed	9.0.70-2	-

DLA-4244-1 DSA-6120-1 DSA-6121-1

SUSE

Severity: High

Product	Status
Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2025:11695 ADVISORY https://access.redhat.com/errata/RHSA-2025:11696 ADVISORY https://access.redhat.com/errata/RHSA-2025:11741 ADVISORY https://access.redhat.com/errata/RHSA-2025:11742 ADVISORY https://access.redhat.com/errata/RHSA-2025:14177 ADVISORY https://access.redhat.com/errata/RHSA-2025:14178 ADVISORY https://access.redhat.com/errata/RHSA-2025:14179 ADVISORY https://access.redhat.com/errata/RHSA-2025:14180 ADVISORY https://access.redhat.com/errata/RHSA-2025:14181 ADVISORY https://access.redhat.com/errata/RHSA-2025:14182 ADVISORY https://access.redhat.com/errata/RHSA-2025:14183 ADVISORY https://github.com/apache/tomcat/commit/7617b9c247bc77ed0444dd69adcd8aa48777886c ADVISORY https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9 ADVISORY https://github.com/apache/tomcat/commit/d94bd36fb7eb32e790dae0339bc249069649a637 ADVISORY https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49125 ADVISORY https://security-tracker.debian.org/tracker/dla-4244-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6120-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6121-1 ADVISORY https://tomcat.apache.org/security-10.html ADVISORY https://tomcat.apache.org/security-11.html ADVISORY https://tomcat.apache.org/security-9.html ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2025-49125 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02214/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02261/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02280/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02978/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02979/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03024/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1058/ REF http://www.openwall.com/lists/oss-security/2025/06/16/2 REF https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back