Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-49125 BIT-tomcat-2025-49125EUVD-2025-18406GHSA-wc4r-xq3c-5cf3

Apache Tomcat: Security constraint bypass for pre/post-resources

Published Jun 16, 2025 · Updated Nov 3, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat.embed:tomcat-embed-core Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions
may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.7, 10.1.0-M1 – ≤ 10.1.41, 9.0.0.M1 – ≤ 9.0.105, 8.5.0 – ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.46-1 —
Debian 14 tomcat11 11.0.11-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.52-1~deb13u1 DSA-6120-1
Debian 13 tomcat11 11.0.15-1~deb13u1 DSA-6121-1
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.52-1~deb12u1 DSA-6120-1
Debian 12 tomcat9 9.0.70-2 —
Debian 11 tomcat9 9.0.107-0+deb11u1 DLA-4244-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tomcat10 No fix yet —
Ubuntu 26.04 LTS tomcat10 No fix yet —
Ubuntu 25.10 tomcat10 +1 No fix yet —
Ubuntu 24.04 LTS tomcat10 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat9 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat +7 1:10.1.36-1.el10_0.2 RHSA-2025:14179
RHEL 10 tomcat9 +7 1:9.0.87-5.el10_0.3 RHSA-2025:14178
RHEL 9 tomcat +7 1:9.0.87-3.el9_6.3 RHSA-2025:14181
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.6 RHSA-2025:14177
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS tomcat +7 1:9.0.87-1.el9_4.6 RHSA-2025:14180
RHEL 9.2 E4S tomcat +7 1:9.0.87-1.el9_2.6 RHSA-2025:14183
RHEL 8.8 TUS tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
RHEL 8.8 E4S tomcat +7 1:9.0.87-1.el8_8.7 RHSA-2025:14182
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.36-7.redhat_00008.1.el8jws RHSA-2025:11741
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.87-12.redhat_00011.1.el7jws RHSA-2025:11695

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ALSA-2025:14178
AlmaLinux 9 tomcat +7 1:9.0.87-3.el9_6.3 ALSA-2025:14181
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.6 ALSA-2025:14177

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat 1:10.1.36-1.el10_0.2 RLSA-2025:14179
Rocky Linux 10 tomcat9 1:9.0.87-5.el10_0.3 RLSA-2025:14178
Rocky Linux 9 tomcat 1:9.0.87-3.el9_6.3 RLSA-2025:14181
Rocky Linux 8 tomcat 1:9.0.87-1.el8_10.6 RLSA-2025:14177

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES 15 SP7 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
SLES 15 SP7 tomcat11 11.0.9-150600.13.6.1 SUSE-SU-2025:02979-1
SLES 15 SP6 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES 15 SP6 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
SLES 15 SP6 tomcat11 11.0.9-150600.13.6.1 SUSE-SU-2025:02979-1
SLES 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
SLES 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 tomcat 9.0.36-3.145.1 SUSE-SU-2026:1058-1, SUSE-SU-2025:02214-1
SLES for SAP 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES for SAP 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
SLES for SAP 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLES for SAP 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLE HPC 15 SP5 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLE HPC 15 SP5 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
SLE HPC 15 SP4 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SLE HPC 15 SP3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
SUSE Manager Server LTS 4.3 tomcat 9.0.108-150200.91.1 SUSE-SU-2025:03024-1
SUSE Manager Server 4.3 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:02280-1
SUSE Enterprise Storage 7.1 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.106-1.1 openSUSE-SU-2025:15301-1
openSUSE Tumbleweed tomcat10 10.1.42-1.1 openSUSE-SU-2025:15302-1
openSUSE Tumbleweed tomcat11 11.0.8-1.1 openSUSE-SU-2025:15303-1
openSUSE Leap 15.6 tomcat 9.0.106-150200.86.1 SUSE-SU-2025:03024-1, SUSE-SU-2025:02280-1
openSUSE Leap 15.6 tomcat10 10.1.42-150200.5.45.1 SUSE-SU-2025:02978-1, SUSE-SU-2025:02261-1
openSUSE Leap 15.6 tomcat11 11.0.9-150600.13.6.1 SUSE-SU-2025:02979-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.42-1.amzn2023.0.1 ALAS2023-2025-1064
Amazon Linux 2023 tomcat9 +7 1:9.0.106-1.amzn2023.0.1 ALAS2023-2025-1065

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tomcat +7 1:10.1.36-1.el10_0.2 ELSA-2025-14179
Oracle Linux 10 tomcat9 +7 1:9.0.87-5.el10_0.3 ELSA-2025-14178
Oracle Linux 9 tomcat +7 1:9.0.87-3.el9_6.3 ELSA-2025-14181
Oracle Linux 8 tomcat +7 1:9.0.87-1.el8_10.6 ELSA-2025-14177

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard +4 4.0.1-r8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.8 11.0.8 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.42 10.1.42 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.106 9.0.106 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100 — GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.8 11.0.8 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.42 10.1.42 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.106 9.0.106 GHSA-wc4r-xq3c-5cf3
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100 — GHSA-wc4r-xq3c-5cf3

Advisories 38

References