PT-2025-40606 · Mastra · Mastra

Lirantal · Published 2025-09-24 · Updated 2025-10-03 · CVE-2025-61685

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastra versions 0.13.8 through 0.13.20-alpha.0

Description Mastra, a Typescript framework for building AI agents and assistants, is susceptible to a Directory Traversal issue. The framework includes a security check intended to prevent path traversal when reading file contents, but this check is bypassed by subsequent logic used to find directory suggestions. This allows an attacker to list the contents of arbitrary directories on the user's filesystem, potentially exposing sensitive information about the file system's structure, including the user's home directory.

Recommendations Update to version 0.13.20 or later.

Exploit

Fix

Weakness Enumeration

CWE-548

Related Identifiers

CVE-2025-61685

GHSA-XH92-RQRQ-227V

Affected Products

Mastra

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61685.json · Exploit
• https://osv.dev/vulnerability/GHSA-xh92-rqrq-227v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61685 · Security Note
• https://github.com/mastra-ai/mastra/commit/7f2b528ba82db512d68832d2f8ad6cbc8bb46cd4 · Note
• https://github.com/mastra-ai/mastra/security/advisories/GHSA-xh92-rqrq-227v · Note
• https://github.com/mastra-ai/mastra · Note
• https://t.me/cveNotify/137379 · Telegram Post
• https://t.me/CVEtracker/34069 · Telegram Post
• https://twitter.com/CVEnew/status/1974245751955062942 · Twitter Post