Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2swz-5ukp-1qgj
Vulnerability ID VCID-2swz-5ukp-1qgj
Aliases CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Summary auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 External Control of File Name or Path
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-58769
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-58769
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-58769
cvssv3.1_qr LOW https://github.com/advisories/GHSA-9mh6-g99m-ppcw
cvssv3.1 3.3 https://github.com/auth0/auth0-PHP
generic_textual LOW https://github.com/auth0/auth0-PHP
cvssv3.1 3.3 https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
generic_textual LOW https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
ssvc Track https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
cvssv3.1 3.3 https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
generic_textual LOW https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
ssvc Track https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
cvssv3.1 3.3 https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
cvssv3.1_qr LOW https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
generic_textual LOW https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
ssvc Track https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
cvssv3.1 3.3 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
generic_textual LOW https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
ssvc Track https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
cvssv3.1 3.3 https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
generic_textual LOW https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
ssvc Track https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
cvssv3.1 3.3 https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
generic_textual LOW https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
ssvc Track https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2025-58769
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-58769
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-58769
https://github.com/auth0/auth0-PHP
8.17.0 https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
9026da58f5c381cd4cb5932de829eff6eacbb65c https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
CVE-2025-58769 https://nvd.nist.gov/vuln/detail/CVE-2025-58769
GHSA-7jp2-5h22-m432 https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
GHSA-9mh6-g99m-ppcw https://github.com/advisories/GHSA-9mh6-g99m-ppcw
GHSA-9mh6-g99m-ppcw https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
GHSA-hjfh-5jmm-xr24 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
GHSA-w22c-pw5m-482x https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/auth0-PHP
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T20:09:35Z/ Found at https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-58769
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.27537
EPSS Score 0.00102
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:59:23.988903+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/58xxx/CVE-2025-58769.json 38.6.0