CVE-2025-67845

MEDIUM6.4

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences

Published Dec 19, 2025

Modified 4 weeks ago

No fix available

Details

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.

References

WEBhttps://heartbreak.ing/WEBhttps://kibty.town/blog/mintlify/WEBhttps://news.ycombinator.com/item?id=46317098 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-67845 WEBhttps://www.mintlify.com/blog/working-with-security-researchers-november-2025 WEBhttps://www.mintlify.com/docs/changelog

CVSS Analysis

CVSS v3.1

6.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

6.4/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness Type (CWE)

Other

CWE-24

Ecosystems

Timeline

PublishedDec 19, 2025

ModifiedDec 19, 2025