CVE-2025-11842CWE-22path-traversal

CVE-2025-11842

Medium · published October 16, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-16T20:15Z
References (5)
https://github.com/Shazwazza/Smidge/releases/tag/v4.6.0 · [email protected]https://github.com/asust9/smidge-vuln?tab=readme-ov-file · [email protected]https://vuldb.com/?ctiid.328776 · [email protected]https://vuldb.com/?id.328776 · [email protected]https://vuldb.com/?submit.664905 · [email protected]
EPSS history
Timeline
  • 16 OCT 15:32Z
    Shazwazza Smidge Bundle path traversal
    cvelistv5