False finding for CVE-2025-41242

Author: fdevans

docs/history/cves/CVE-2025-41242.md

@@ -0,0 +1,13 @@
+---
+order: 51
+---
+
+# CVE-2025-41242
+
+## Path traversal vulnerability on non-compliant Servlet containers
+
+::: danger FALSE POSITIVE
+ Rundeck and Runbook Automation are not vulnerable to this CVE.
+:::
+
+This is a Spring vulnerability, but the [CVE article](https://spring.io/security/cve-2025-41242) says "deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration."  The Rundeck product does not disable disable the default security features.

docs/history/cves/CVE-2025-48924.md

@@ -1,5 +1,5 @@
 ---
-order: 51
+order: 52
 ---
 
 # CVE-2025-48924