{"id":"EUVD-2025-34861","enisaUuid":"671a59f8-42b6-304d-96a4-db9da60835c9","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","datePublished":"Oct 17, 2025, 5:00:06 AM","dateUpdated":"Oct 17, 2025, 2:24:39 PM","baseScore":6.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470\nhttps://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967\nhttps://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968\nhttps://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969\nhttps://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10\nhttps://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820\n","aliases":"CVE-2025-11849\nGHSA-rmjr-87wv-gf87\n","assigner":"snyk","epss":1.13,"enisaIdProduct":[{"id":"add94d5d-e3a2-3acd-8bdb-69c1900fdaae","product":{"name":"org.zwobble.mammoth:mammoth","vendor":{"name":"n/a"}},"product_version":"0 \u003c1.11.0"},{"id":"e2a8cfc0-c3dd-3591-8664-56f1ffa27dfe","product":{"name":"mammoth","vendor":{"name":"n/a"}},"product_version":"0 \u003c1.11.0"},{"id":"e2c1b890-8cf9-34a1-a6ab-b8765abb6077","product":{"name":"mammoth","vendor":{"name":"n/a"}},"product_version":"0.3.25 \u003c1.11.0"}],"enisaIdVendor":[{"id":"e22011e4-f19f-3e50-aeb9-6914954fab56","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"3714ccd7-7a52-3ba9-986f-2f2ad8816623","vulnerability":{"id":"GHSA-rmjr-87wv-gf87","description":"Mammoth is vulnerable to Directory Traversal","datePublished":"Oct 17, 2025, 6:31:11 AM","dateUpdated":"Oct 17, 2025, 5:50:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-11849\nhttps://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820\nhttps://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10\nhttps://github.com/mwilliamson/java-mammoth\nhttps://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968\nhttps://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969\nhttps://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470\nhttps://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967\n","enisa_id":"EUVD-2025-34861\n","aliases":"CVE-2025-11849\nGHSA-rmjr-87wv-gf87\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"44a84c98-e8ca-3ab7-b9d6-e9cf113080f7","vulnerability":{"id":"PYSEC-2026-1603","description":"Mammoth is vulnerable to Directory Traversal","datePublished":"Jul 7, 2026, 4:03:07 PM","dateUpdated":"Jul 7, 2026, 5:24:37 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-11849\nhttps://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820\nhttps://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10\nhttps://github.com/mwilliamson/java-mammoth\nhttps://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968\nhttps://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969\nhttps://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470\nhttps://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967\nhttps://pypi.org/project/mammoth\nhttps://github.com/advisories/GHSA-rmjr-87wv-gf87\n","enisa_id":"EUVD-2025-34861\n","aliases":"CVE-2025-11849\nGHSA-rmjr-87wv-gf87\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:14:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ff2b3f01-9b3b-3907-ae1d-4256531f1d3e","vulnerability":{"id":"CVE-2025-11849","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","datePublished":"Oct 17, 2025, 5:00:06 AM","dateUpdated":"Oct 17, 2025, 2:24:39 PM","status":"PUBLISHED","baseScore":6.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470\nhttps://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967\nhttps://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968\nhttps://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969\nhttps://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10\nhttps://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820\n","enisa_id":"EUVD-2025-34861\n","assigner":"snyk","epss":1.13,"dataProcessed":"Nov 6, 2026, 7:17:15 AM","vulnerabilityProduct":[{"id":"06c7fd8c-58f0-3c49-afec-9471fe256688","product":{"name":"mammoth","vendor":{"name":"n/a"}},"product_version":"0 \u003c1.11.0"},{"id":"e5f46867-6ca8-3f38-a300-3a9a7b652f5b","product":{"name":"org.zwobble.mammoth:mammoth","vendor":{"name":"n/a"}},"product_version":"0 \u003c1.11.0"},{"id":"feed2277-4d03-3028-8b0a-fc628bb639c3","product":{"name":"mammoth","vendor":{"name":"n/a"}},"product_version":"0.3.25 \u003c1.11.0"}],"vulnerabilityVendor":[{"id":"ae45a60d-e954-3d5b-b214-dd45cf8a3254","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}