PT-2025-40296 · Auth0+1 · Auth0-Php+4

Mohamed Amine Saidani + 1 · Publicado 2025-10-01 · Atualizado 2025-10-02 · CVE-2025-58769

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions auth0-PHP versions 3.3.0 through 8.16.0

Description The Bulk User Import endpoint does not validate file path wrappers or values, potentially allowing acceptance of arbitrary file paths or URLs. This affects applications directly using the Auth0-PHP SDK versions 3.3.0 through 8.16.0, as well as applications relying on Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs that utilize the affected Auth0-PHP SDK versions. The issue stems from a lack of proper validation when processing file paths. The vulnerable endpoint is the Bulk User Import endpoint.

Recommendations Upgrade Auth0-PHP to version 8.17.0 or greater.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-434

CWE-22

Identificadores relacionados

CVE-2025-58769

GHSA-7JP2-5H22-M432

GHSA-9MH6-G99M-PPCW

GHSA-HJFH-5JMM-XR24

GHSA-W22C-PW5M-482X

Produtos afetados

Auth0/Laravel-Auth0

Auth0/Symfony

Auth0/Wordpress

Wordpress

Auth0-Php

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58769.json · Exploit
• https://github.com/auth0/auth0-PHP · Nota
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw · Nota
• https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c · Nota
• https://github.com/auth0/auth0-PHP/releases/tag/8.17.0 · Nota
• https://github.com/auth0/laravel-auth0 · Nota
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24 · Nota
• https://github.com/auth0/laravel-auth0/commit/c33c609fb041f7fe65deb6133feee0cb33fa80a5 · Nota
• https://github.com/auth0/laravel-auth0/releases/tag/7.19.0 · Nota
• https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x · Nota
• https://github.com/auth0/symfony · Nota
• https://github.com/auth0/symfony/releases/tag/5.5.0 · Nota
• https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432 · Nota
• https://github.com/auth0/symfony/commit/0b6dbd1a7e6ffeebf4cbb08831c9ca9052d2c577 · Nota
• https://twitter.com/CVEnew/status/1973486768029683943 · Publicação no Twitter