CVE-2025-54387 IPX is Vulnerable to Path Traversal via Prefix Matching Bypass
Attackers can read files outside allowed directories in IPX due to a path prefix bypass vulnerability in directory checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54387?
CVE-2025-54387 is a medium-severity path traversal vulnerability in unjs ipx, published on 5 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.
Weakness: CWE-22
Which versions are affected by CVE-2025-54387?
6 open source packages ship an affected version, including ipx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ipx npm | All versions | 1.3.2 |
ipx npm | All versions | 1.3.2 |
ipx npm | From 2.0.0-0 | 2.1.1 |
ipx npm | From 2.0.0-0 | 2.1.1 |
ipx npm | From 3.0.0 | 3.1.1 |
ipx npm | From 3.0.0 | 3.1.1 |
Products include Unjs Ipx.
How do I fix CVE-2025-54387?
Upgrade ipx to a fixed version for your release line: 1.3.2, 2.1.1 or 3.1.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-54387 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54387 exists.
Sources
Also known as GHSA-mm3p-j368-7jcr.