medium6.3
CVE-2025-11842
Smidge is vulnerable to Path Traversal
Impact
A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Smidge | < 4.6.0 | 4.6.0 |
Affected products
| Product | Affected versions |
|---|---|
| Shazwazza Smidge | before 4.5.1. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Shazwazza/Smidge/releases/tag/v4.6.0
- https://github.com/asust9/smidge-vuln?tab=readme-ov-file
- https://vuldb.com/?ctiid.328776
- https://vuldb.com/?id.328776
- https://vuldb.com/?submit.664905
- https://github.com/advisories/GHSA-9rvm-p3qm-f4vv
- https://nvd.nist.gov/vuln/detail/CVE-2025-11842