GHSA-hjfh-5jmm-xr24
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import
GHSA-hjfh-5jmm-xr24 is a low vulnerability (CVSS 3.3) in auth0/login, published October 1, 2025. No source lists public exploit code. Fixed in auth0/login 7.19.0.
- Severity
- 3.3 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.19.0auth0/login +1 more
Description
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
auth0/loginPackagist | 4.0.0 to 7.18.0 | 7.19.0 |
auth0/loginPackagist | 4.0.0 up to 7.19.0, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 45 moreShow less4.0.64.0.74.0.85.0.05.0.15.0.25.1.05.2.05.3.05.3.15.4.06.0.06.0.16.1.06.2.06.3.06.4.06.4.16.5.07.0.07.0.0-BETA17.0.0-BETA27.0.17.1.07.10.07.10.17.11.07.12.07.13.07.14.07.15.07.16.07.17.07.18.07.2.07.2.17.2.27.3.07.4.07.5.07.5.17.5.27.6.07.7.07.8.0 | 7.19.0 |
What each source reports
GitHub Advisories Score used
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
- Record
GHSA-hjfh-5jmm-xr24- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
- Record
GHSA-hjfh-5jmm-xr24- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
nvd.nist.gov/vuln/detail/CVE-2025-58769
Left out here: 3 versions. The JSON record has them.