{"id":"CVE-2025-11849","aliases":["GHSA-rmjr-87wv-gf87","PYSEC-2026-1603"],"title":"Mammoth is vulnerable to Directory Traversal","summary":"Mammoth is vulnerable to Directory Traversal","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H","vendor":"mammoth","product":"mammoth","ecosystem":"npm","affected":["mammoth >= 0.3.25, < 1.11.0","org.zwobble.mammoth:mammoth < 1.11.0","mammoth >= 0.3.25, < 1.11.0","Mammoth < 1.11.0"],"patched":["mammoth 1.11.0","org.zwobble.mammoth:mammoth 1.11.0","mammoth 1.11.0","Mammoth 1.11.0"],"published":"2025-10-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rmjr-87wv-gf87","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11849"},{"url":"https://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820"},{"url":"https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10"},{"url":"https://github.com/mwilliamson/java-mammoth"},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968"},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969"},{"url":"https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470"},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967"}],"tags":["osv","npm"],"epss":0.0101,"epssPercentile":0.6165,"ingestedAt":"2026-07-08T18:25:52.986Z","slug":"CVE-2025-11849","body":"## Overview\n\nVersions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.\n\n## Affected packages\n\n- `mammoth >= 0.3.25, < 1.11.0`\n- `org.zwobble.mammoth:mammoth < 1.11.0`\n- `mammoth >= 0.3.25, < 1.11.0`\n- `Mammoth < 1.11.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mammoth 1.11.0`\n- `org.zwobble.mammoth:mammoth 1.11.0`\n- `mammoth 1.11.0`\n- `Mammoth 1.11.0`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}