--- cve: "CVE-2025-11849" severity: "MEDIUM" cvss: 6.4 epss: "94%" vendor: "n/a" kev: false exploited: false published: "2025-10-17 05:15:33" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-19T00:39:14+02:00" --- # CVE-2025-11849 > 6.4 MEDIUM · 🧪 PoC ## Beschreibung Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero. ## CVSS-Vektor ``` CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | ## Patch verfügbar (OSV) - 3261fbb689a2d54c151d6be7fa653553735e5861 (Commit) - 3261fbb689a2d54c151d6be7fa653553735e5861 (Commit) ## Referenzen - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-11849) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_