{"action":"Upgrade mammoth to 1.11.0 or later.","affected":[{"fixed":"1.11.0","introduced":"0.3.25"}],"component":"mammoth","cve_ids":["CVE-2025-11849"],"ecosystem":"npm","epss":0.01126,"exploited":false,"fixed_versions":["1.11.0"],"ghsa_id":"GHSA-rmjr-87wv-gf87","id":"tcs_01M5KFYAF383BVGCBHFYF5H8AM","modified_at":"2026-07-07T17:56:05.627288066Z","published_at":"2025-10-17T06:31:11Z","references":["https://osv.dev/vulnerability/GHSA-rmjr-87wv-gf87","https://nvd.nist.gov/vuln/detail/CVE-2025-11849","https://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820","https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10","https://github.com/mwilliamson/java-mammoth","https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968","https://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969","https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470","https://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-rmjr-87wv-gf87","url":"https://osv.dev/vulnerability/GHSA-rmjr-87wv-gf87"}],"summary":"Mammoth is vulnerable to Directory Traversal"}