CVE-2025-48050CWE-24

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory

High · published May 15, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2025-05-15T00:00Z
EPSS history
Timeline
  • 15 MAY 00:00Z
    In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory
    cvelistv5