CVE-2025-58769

Katalog CVE

CVSS 3.3 · Low EPSS 0,35%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 3.3 (Low) menurut github.com.

Deskripsi (NVD)

auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.

Rincian

Terbit di NVD

1 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

3.3 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
• https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
• https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
• https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x