CVE-2025-11849

Critical

Published: 17 October 2025

Published

17 October 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

EPSS Score 0.0023 46.0th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11849 is a critical-severity Path Traversal (CWE-22) vulnerability in Snyk (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation directly addresses the vulnerability by requiring upgrade to Mammoth 1.11.0 or later, which adds path and file type validation to block directory traversal.

SI-10 Information Input Validation good match

prevent

Information input validation requires checking external link URIs in DOCX files for path traversal and invalid file types before resolution and reading.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Vulnerability monitoring and scanning identifies vulnerable Mammoth library versions in dependencies using tools like npm audit or Snyk, enabling remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The directory traversal vulnerability enables arbitrary file reads from the local system (T1005) by crafting malicious DOCX files processed by vulnerable Mammoth library instances, and facilitates exploitation of public-facing applications or services using the library (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due…

to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.

Deeper analysisAI

CVE-2025-11849 is a directory traversal vulnerability (CWE-22) affecting multiple implementations of the Mammoth library, a tool for converting DOCX files to HTML. Vulnerable versions include the JavaScript package mammoth from 0.3.25 up to but not including 1.11.0, the Java package org.zwobble.mammoth:mammoth before 1.11.0, and corresponding .NET variants before 1.11.0. The issue arises from insufficient path and file type validation when processing DOCX files containing images with external hyperlinks via the r:link attribute rather than embedded r:embed relationships. The library resolves the specified URI to a local file path, reads the content, encodes it as base64, and embeds it as a data URI in the resulting HTML output.

The vulnerability has a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H), indicating critical severity with network accessibility, low complexity, no privileges required, user interaction needed, changed scope, high confidentiality and availability impacts, but no integrity impact. A remote attacker can exploit it by crafting a malicious DOCX file with an image external link pointing to arbitrary system files or special devices like /dev/random or /dev/zero. When a victim processes the file using a vulnerable Mammoth instance—such as in a web application or document converter—the attacker can achieve arbitrary file disclosure by extracting base64 data from the HTML output or cause denial of service through excessive resource consumption from reading infinite or high-entropy data streams.

Advisories from Snyk (SNYK-JS-MAMMOTH-13554470, SNYK-DOTNET-MAMMOTH-13561968, SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969) and a fix commit in the mammoth.js repository (c54aaeb43a7941317c1f3c119ffa92090f988820) recommend upgrading to Mammoth version 1.11.0 or later, which introduces proper path and file type validation to prevent traversal and unsafe file access. A proof-of-concept is detailed in a GitHub Gist (https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10). Practitioners should audit dependencies using tools like npm audit or Snyk and validate all user-supplied DOCX inputs prior to processing.