Log in Start free

Vulnerability · Published Oct 17, 2025 · Assigned by snyk

CVE-2025-11849

Critical 9.3

In plain English

A critical-severity path traversal in mammoth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.zwobble.mammoth:mammoth1.11.0GHSA-rmjr-87wv-gf87
NuGetmammoth1.11.0GHSA-rmjr-87wv-gf87
PyPImammoth1.11.0GHSA-rmjr-87wv-gf87
PyPImammoth1.11.0PYSEC-2026-1603
npmmammoth1.11.0GHSA-rmjr-87wv-gf87

Affected products (as reported)

VendorProductVersions
n/a mammoth 0.3.25 – before 1.11.0
n/a mammoth 0.3.25 – before 1.11.0
n/a Mammoth 0 – before 1.11.0
n/a org.zwobble.mammoth:mammoth 0 – before 1.11.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H/E:P

References