CVE-2025-67845

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-24

Affected software

VendorProductVersions
MintlifyMintlify Platform< 2025-11-15

References

Timeline

Published
Dec 19, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-678466.5The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgradCVE-2025-678478.8A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is CVE-2025-678488.1A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools InterCVE-2025-678496.1A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows atCVE-2025-67854.7Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CANCVE-2025-678506.1A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided dataCVE-2025-678517.8A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attaCVE-2025-678526.1A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-coCVE-2025-678537.5A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerabiCVE-2025-678556.1A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return CVE-2025-678569.8A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowCVE-2025-678575.3A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure
CVE-2025-67845: Medium severity, CVSS 5.4 | Vulnix