CVE-2025-11849
Full vulnerability record from the local CVENow database.
Description
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.
Severity
MEDIUM
CVSS score
5.4
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-10-17 05:15:33.960000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-11849",
"sourceIdentifier": "[email protected]",
"published": "2025-10-17T05:15:33.960",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero."
},
{
"lang": "es",
"value": "Versiones del paquete mammoth desde 0.3.25 y anteriores a 1.11.0; versiones del paquete mammoth desde 0.3.25 y anteriores a 1.11.0; versiones del paquete mammoth anteriores a 1.11.0; versiones del paquete org.zwobble.mammoth:mammoth anteriores a 1.11.0 son vulnerables a salto de directorio debido a la falta de validación de ruta o tipo de archivo al procesar un archivo docx que contiene una imagen con un enlace externo (atributo r:link en lugar de r:embed incrustado). La biblioteca resuelve la URI a una ruta de archivo y después de la lectura, el contenido se codifica como base64 y se incluye en la salida HTML como una URI de datos. Un atacante puede leer archivos arbitrarios en el sistema donde se realiza la conversión o causar un consumo excesivo de recursos al crear un archivo docx que enlaza a archivos de dispositivo especiales como /dev/random o /dev/zero."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "mammoth",
"versions": [
{
"version": "0.3.25",
"lessThan": "1.11.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "n/a",
"product": "mammoth",
"versions": [
{
"version": "0.3.25",
"lessThan": "1.11.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "n/a",
"product": "Mammoth",
"versions": [
{
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "n/a",
"product": "org.zwobble.mammoth:mammoth",
"versions": [
{
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-17T14:24:36.088431Z",
"id": "CVE-2025-11849",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10",
"source": "[email protected]"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820",
"source": "[email protected]"
},
{
"url": "https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968",
"source": "[email protected]"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969",
"source": "[email protected]"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470",
"source": "[email protected]"
},
{
"url": "https://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967",
"source": "[email protected]"
},
{
"url": "https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}