BaseFortify

Publication date: 2025-10-17

Last updated on: 2026-04-29

Assigner: Snyk

Description

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-17

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-10-17

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11849

EUVD

EUVD-2025-34861

Affected Vendors & Products

Vendor	Product	Version / Range
org.zwobble.mammoth	mammoth	0.3.25
org.zwobble.mammoth	mammoth	1.11.0
org.zwobble.mammoth	mammoth	1.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a Directory Traversal issue in the mammoth package before version 1.11.0. It occurs because the package does not properly validate paths or file types when processing a docx file that contains an image linked via an external reference (r:link attribute) instead of embedding it (r:embed). The library resolves the URI to a file path and reads the content, which is then encoded as base64 and included in the HTML output. An attacker can exploit this to read arbitrary files on the system where the conversion happens or cause excessive resource consumption by linking to special device files like /dev/random or /dev/zero.

Impact Analysis

This vulnerability can allow an attacker to read arbitrary files on the system performing the docx to HTML conversion, potentially exposing sensitive information. Additionally, an attacker can cause excessive resource consumption by linking to special device files, which may lead to denial of service or system instability.

Hi! I’m here to help you understand CVE-2025-11849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70