Cyber Resilience

CVE-2025-61685

Info Disclosure

Published
03 October 2025
Modified
15 April 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0054 43th percentile
Risk Priority 51 floored blend · peak EPSS

Summary

CVE-2025-61685 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Privacy and Disclosure risk domain.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent path traversal…

more

for reading file contents, but this check is effectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw to list the contents of arbitrary directories on the user's filesystem, including the user's home directory, exposing sensitive information about the file system's structure. This issue is fixed in version 0.13.20.

CWE(s)

AI Security AnalysisAI

AI Category
AI Agent Protocols and Integrations
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise Techniques

T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-32750Shared CWE-548
CVE-2025-2827Shared CWE-548
CVE-2026-50233Shared CWE-548
CVE-2024-8711Shared CWE-548
CVE-2024-56464Shared CWE-548
CVE-2024-35113Shared CWE-548
CVE-2025-45320Shared CWE-548
CVE-2024-22082Shared CWE-548
CVE-2024-3707Shared CWE-548
CVE-2025-27452Shared CWE-548

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Requires secure baseline settings that disable directory listing on servers and file shares.

Restricts unnecessary server features such as automatic directory indexing.

Enforces authorization decisions so that directory listings are never returned unless explicitly permitted.

Controls information flows so directory contents are not disclosed to unauthorized recipients.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened baselines and config management directly disable directory listing by default.

ID.AM-08 partial match
prevents

Lifecycle management includes applying secure configurations that would prevent directory exposure.

ID.RA-01 partial match
prevents

Vulnerability scanning can discover exposed directories so they can be remediated.

PR.AA-05 partial match
prevents

Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.

finds

Security testing in development and acceptance can detect and require remediation of exposed directory listings.

degrades

Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.

prevents

Secure development life cycle includes configuration hardening that disables directory listing in production web servers.

prevents

Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.

prevents

Secure system architecture principles include configuring web servers to prevent automatic directory listings.

References