CVE-2025-11849

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11849
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11849.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11849
Aliases
Published
2025-10-17T05:00:06.278Z
Modified
2026-08-12T03:51:37.490440776Z
Severity
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11849.json",
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/mwilliamson/mammoth.js

Affected ranges

Type
GIT
Repo
https://github.com/mwilliamson/mammoth.js
Events
Introduced
d73dce45a781a15e18a953a3507fb3ccd740ed89
Fixed
3261fbb689a2d54c151d6be7fa653553735e5861
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3261fbb689a2d54c151d6be7fa653553735e5861
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.3.25"
        },
        {
            "fixed": "1.11.0"
        },
        {
            "introduced": "0"
        }
    ]
}

Affected versions

0.*
0.3.25
0.3.26
0.3.27
0.3.28
0.3.28-pre.1
0.3.29
0.3.30
0.3.31
0.3.32
0.3.33
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.10.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0
1.4.1
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.4.15
1.4.16
1.4.17
1.4.18
1.4.19
1.4.2
1.4.20
1.4.21
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11849.json"