GHSA-hjfh-5jmm-xr24 laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import
Attackers can exploit the Bulk User Import endpoint to access arbitrary files or URLs due to missing validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hjfh-5jmm-xr24?
GHSA-hjfh-5jmm-xr24 is a path traversal vulnerability in auth0/login, published on 1 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
Which versions are affected by GHSA-hjfh-5jmm-xr24?
2 open source packages ship an affected version, including auth0/login.
| Package | Affected | Fixed in |
|---|---|---|
auth0/login Packagist | From 4.0.0 | 7.19.0 |
auth0/login Packagist | From 4.0.0 | 7.19.0 |
How do I fix GHSA-hjfh-5jmm-xr24?
Upgrade auth0/login to 7.19.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-hjfh-5jmm-xr24 being exploited?
There is no known exploitation of GHSA-hjfh-5jmm-xr24 in the wild and no public exploit code.