CVE-2025-11842

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11842
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11842.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11842
Aliases
Published
2025-10-16T15:32:14.804Z
Modified
2026-07-08T07:56:55.299196481Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Shazwazza Smidge Bundle path traversal
Details

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11842.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/shazwazza/smidge

Affected ranges

Type
GIT
Repo
https://github.com/shazwazza/smidge
Events
Introduced
3ad9bfe975f2304cd7f3cc480bda405f2af6f5a2
Fixed
40c8acc8018d5c190f574b26f2868ee025f6f583
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.5.0"
        },
        {
            "last_affected": "4.5.0"
        },
        {
            "introduced": "4.5.1"
        },
        {
            "last_affected": "4.5.1"
        }
    ]
}

Affected versions

4.*
4.5.0
4.5.1
v4.*
v4.5.0
v4.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11842.json"