PT-2025-40296 · Auth0+1 · Auth0-Php+4

Mohamed Amine Saidani + 1 · Published 2025-10-01 · Updated 2025-10-02 · CVE-2025-58769

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions auth0-PHP versions 3.3.0 through 8.16.0

Description The Bulk User Import endpoint does not validate file path wrappers or values, potentially allowing acceptance of arbitrary file paths or URLs. This affects applications directly using the Auth0-PHP SDK versions 3.3.0 through 8.16.0, as well as applications relying on Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs that utilize the affected Auth0-PHP SDK versions. The issue stems from a lack of proper validation when processing file paths. The vulnerable endpoint is the Bulk User Import endpoint.

Recommendations Upgrade Auth0-PHP to version 8.17.0 or greater.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-73

CWE-434

CWE-22

Related Identifiers

CVE-2025-58769

GHSA-7JP2-5H22-M432

GHSA-9MH6-G99M-PPCW

GHSA-HJFH-5JMM-XR24

GHSA-W22C-PW5M-482X

Affected Products

Auth0/Laravel-Auth0

Auth0/Symfony

Auth0/Wordpress

Wordpress

Auth0-Php

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58769.json · Exploit
• https://osv.dev/vulnerability/GHSA-hjfh-5jmm-xr24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58769 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58769 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jp2-5h22-m432 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9mh6-g99m-ppcw · Vendor Advisory
• https://github.com/auth0/auth0-PHP · Note
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw · Note
• https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c · Note
• https://github.com/auth0/auth0-PHP/releases/tag/8.17.0 · Note
• https://github.com/auth0/laravel-auth0 · Note
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24 · Note
• https://github.com/auth0/laravel-auth0/commit/c33c609fb041f7fe65deb6133feee0cb33fa80a5 · Note
• https://github.com/auth0/laravel-auth0/releases/tag/7.19.0 · Note
• https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x · Note