PyPI/unstructured CVE-2025-64712: critical 9.8, EPSS 0.67%
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Action: Upgrade unstructured to 0.18.18 or later.
pip install unstructured==0.18.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.18.18 | - |
Fixed versions
| 0.18.18 |
Sources
- osv: GHSA-gm8q-m8mv-jj5m
- https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-gm8q-m8mv-jj5m
- https://nvd.nist.gov/vuln/detail/CVE-2025-64712
- https://github.com/Unstructured-IO/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d
- https://github.com/Unstructured-IO/unstructured
CVE-2025-64712 · published · modified · JSON