UpHeron
All vulnerabilities

Servers and applications

CVE-2025-49125

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be…

Severity
High 7.5
Published
16 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.106, 10.1.42, 11.0.8
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 9.0.0 before 9.0.106
  • From 10.1.0 before 10.1.42
  • From 11.0.0 before 11.0.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-49125
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-49125