PT-2025-30309 · Marshmallow Packages+2 · Nova-Tiptap+2

Stef Van Esch + 1 · Published 2025-07-21 · Updated 2025-07-21 · CVE-2025-54082

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions marshmallow-packages/nova-tiptap versions prior to 5.7.0

Description marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. A missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint, combined with a lack of validation on uploaded files and dynamic disk parameter selection, allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. An attacker can craft a custom form and send a POST request to the /nova-tiptap/api/file endpoint, supplying a valid CSRF token, to upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used, the attacker may gain the ability to execute or distribute arbitrary files.

Recommendations Update marshmallow-packages/nova-tiptap to version 5.7.0 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-54082

GHSA-96C2-H667-9FXP

Affected Products

Laravel Nova

Nova-Tiptap

Tiptap

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54082.json · Exploit
• https://osv.dev/vulnerability/GHSA-96c2-h667-9fxp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54082 · Security Note
• https://github.com/marshmallow-packages/nova-tiptap/commit/fed42d2f8ebb9e3c74f1ee262c9db33567030756 · Note
• https://github.com/marshmallow-packages/nova-tiptap/security/advisories/GHSA-96c2-h667-9fxp · Note
• https://github.com/marshmallow-packages/nova-tiptap · Note
• https://twitter.com/CVEnew/status/1947339049179513334 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947394653554200656 · Twitter Post