CVE-2025-49125 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 7.5 High CVSS 3.1 |
| Fixed in | 11.0.8, 10.1.42, 9.0.106 |
| Weakness | CWE-288 |
| Published | 16 Jun 2025 |
| Updated | 17 Jun 2026 |
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 2.6% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Tomcat CVE | 2025-06-03 |
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists: apache/tomcat 7617b9c.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all |
|---|---|
| Finding | This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious. |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2025 ↗ | CPU | 2025-Q4 | Oracle Retail Applications / Xenvironment (Apache Tomcat) (24.0.1) Oracle Siebel CRM / User Interface (Apache Tomcat) (Prior to 25.10) |
| Oracle Critical Patch Update July 2025 ↗ | CPU | 2025-Q3 | Oracle Communications / CMP (Apache Tomcat) (15.0.0.0) Oracle Communications / Web UI (Apache Tomcat) (9.0.0-9.0.4) Oracle Communications Applications / Core (Apache Tomcat) (6.0.5-6.1.0) Oracle Utilities Applications / Tools (Apache Tomcat) (7.0.0.0.0, 7.0.0.1.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | CMP (Apache Tomcat) | 15.0.0.0 | 15.0.0.0 |
| Oracle Communications | Web UI (Apache Tomcat) | 9.0.0-9.0.4 | |
| Oracle Communications Applications | Core (Apache Tomcat) | 6.0.5-6.1.0 | |
| Oracle Retail Applications | Xenvironment (Apache Tomcat) | 24.0.1 | 24.0.1 |
| Oracle Siebel CRM | User Interface (Apache Tomcat) | Prior to 25.10 | |
| Oracle Utilities Applications | Tools (Apache Tomcat) | 7.0.0.0.0, 7.0.0.1.0 | 7.0.0.0.0 · 7.0.0.1.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-catalina |
11.0.0-M1 | 11.0.8 |
unbounded |
org.apache.tomcat:tomcat-catalina |
10.1.0-M1 | 10.1.42 |
unbounded |
org.apache.tomcat:tomcat-catalina |
9.0.0.M1 | 9.0.106 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
11.0.0-M1 | 11.0.8 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
10.1.0-M1 | 10.1.42 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
9.0.0.M1 | 9.0.106 |
unbounded |
org.apache.tomcat:tomcat-catalina |
8.5.0 | none | 8.5.100 |
org.apache.tomcat.embed:tomcat-embed-core |
8.5.0 | none | 8.5.100 |
Products and versions
3 products, 11 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 9.0.0 and ＜ 9.0.106 · ≥ 10.1.0 and ＜ 10.1.42 · ≥ 11.0.0 and ＜ 11.0.8 |
| osv | org.apache.tomcat | tomcat-catalina | generic | ≥ 8.5.0 and ≤ 8.5.100 · ≥ 9.0.0 and ＜ 9.0.106 · ≥ 10.1.0 and ＜ 10.1.42 · ≥ 11.0.0 and ＜ 11.0.8 |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 8.5.0 and ≤ 8.5.100 · ≥ 9.0.0 and ＜ 9.0.106 · ≥ 10.1.0 and ＜ 10.1.42 · ≥ 11.0.0 and ＜ 11.0.8 |
References
Timeline
Timeline
| Published | 2025-06-16 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |