CVE-2025-48050 Path traversal in DOMPurify
A path traversal vulnerability in DOMPurify's development server script allows reading files outside the working directory if manually started.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48050?
CVE-2025-48050 is a high-severity path traversal vulnerability in Cure53 DOMPurify, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
Weakness: CWE-24
Which versions are affected by CVE-2025-48050?
How do I fix CVE-2025-48050?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-48050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48050 exists.
Sources
Also known as DEBIAN-CVE-2025-48050, GHSA-5h64-37wc-rj27, UBUNTU-CVE-2025-48050.