CVE-2025-11842 Shazwazza Smidge Bundle path traversal
Attackers can exploit a path traversal vulnerability in the Smidge library's Bundle Handler to read arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11842?
CVE-2025-11842 is a medium-severity path traversal vulnerability in Shazwazza Smidge, published on 16 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.
Weakness: CWE-22
Which versions are affected by CVE-2025-11842?
2 open source packages ship an affected version, including Smidge.
| Package | Affected | Fixed in |
|---|---|---|
Smidge NuGet | All versions | 4.6.0 |
Smidge NuGet | All versions | 4.6.0 |
How do I fix CVE-2025-11842?
Upgrade Smidge to 4.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-11842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11842 exists.
Sources
Also known as GHSA-9rvm-p3qm-f4vv.