CVE-2025-54387

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
unjs	ipx	< 1.3.2; >= 2.0.0-0, < 2.1.1; >= 3.0.0, < 3.1.1

References

https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214Patch
https://github.com/unjs/ipx/releases/tag/v1.3.2Release Notes
https://github.com/unjs/ipx/releases/tag/v2.1.1Release Notes
https://github.com/unjs/ipx/releases/tag/v3.1.1Release Notes
https://github.com/unjs/ipx/security/advisories/GHSA-mm3p-j368-7jcrExploit, Vendor Advisory
https://github.com/unjs/ipx/security/advisories/GHSA-mm3p-j368-7jcrExploit, Vendor Advisory

Timeline

Published: Aug 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-543884.6Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and va CVE-2025-543895.5AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AI CVE-2025-54398.8A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.0 CVE-2025-543906.3A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbra CVE-2025-543919.1A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials CVE-2025-543926.1Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vul CVE-2025-543935.4Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obt CVE-2025-543945.3Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to CVE-2025-543956.1Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data.CVE-2025-543965.4Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit thi CVE-2025-543974.3Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authentic CVE-2025-543998.8Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially cr