{"id":"CVE-2025-11849","aliases":["EUVD-2025-34861","GHSA-rmjr-87wv-gf87","PYSEC-2026-1603"],"status":"published","title":"Mammoth is vulnerable to Directory Traversal","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","severity":{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01126,"percentile":0.66736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-10-17T05:00:06Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"npm","package":"mammoth","fixed_in":["1.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.zwobble.mammoth:mammoth","fixed_in":["1.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"mammoth","fixed_in":["1.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Mammoth","fixed_in":["1.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.25"},{"fixed":"1.11.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.zwobble.mammoth:mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.25"},{"fixed":"1.11.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"npm","package":"mammoth","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.25"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.zwobble.mammoth:mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","1.10.0","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.5.0","1.7.0","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.25"},{"fixed":"1.11.0"}]}],"versions":["0.3.25","0.3.26","0.3.27","0.3.29","0.3.30","0.3.31","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.10.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"NuGet","package":"Mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}],"versions":["0.0.1","0.0.2","1.3.1","1.3.2","1.4.0","1.8.0"]},{"source":"osv","ecosystem":"PyPI","package":"mammoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.25"},{"fixed":"1.11.0"}]}],"versions":["0.3.25","0.3.26","0.3.27","0.3.29","0.3.30","0.3.31","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.10.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"]}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969","tags":["web"]},{"url":"https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10","tags":["exploit","web"]},{"url":"https://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11849","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmjr-87wv-gf87","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11849.json","tags":["advisory"]},{"url":"https://github.com/mwilliamson/java-mammoth","tags":["package"]},{"url":"https://pypi.org/project/mammoth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-11849","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T05:00:06.278Z","modified":"2025-10-17T14:24:39.437Z","cvss":[{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H/E:P","level":"critical","assessor":"cna"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-34861","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T05:00:06Z","modified":"2025-10-17T14:24:39Z","cvss":[{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium"}],"updated_at":"2026-11-02T20:31:30.508055Z"}],"ghsa":[{"id":"GHSA-rmjr-87wv-gf87","title":"Mammoth is vulnerable to Directory Traversal","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T06:31:11Z","modified":"2025-10-17T17:50:01Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"nvd":[{"id":"CVE-2025-11849","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T05:15:33.96Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-11849","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T05:00:06.278Z","modified":"2026-10-28T02:30:27.669563662Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-rmjr-87wv-gf87","title":"Mammoth is vulnerable to Directory Traversal","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2025-10-17T06:31:11Z","modified":"2026-07-07T17:56:05.627288066Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H","level":"critical"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"PYSEC-2026-1603","title":"Mammoth is vulnerable to Directory Traversal","description":"Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.","status":"published","published":"2026-07-07T16:03:07.843563Z","modified":"2026-07-07T17:46:15.308467092Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H","level":"critical"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}