CVE-2025-67845

5.4 mediumEPSS 0.5%

Medium (5.4) in mintlify mintlify. EPSS 0.5% chance of exploitation in the next 30 days.

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-11-01)
CWE: CWE-24
Published: 2025-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mintlify:mintlify

References

https://heartbreak.ing/
https://kibty.town/blog/mintlify/
https://news.ycombinator.com/item?id=46317098
https://www.mintlify.com/blog/working-with-security-researchers-november-2025
https://www.mintlify.com/docs/changelog

Check your stack JSON