{"action":"Upgrade mammoth to 1.11.0 or later.","affected":[{"fixed":"1.11.0","introduced":"0.3.25"}],"component":"mammoth","cve_ids":["CVE-2025-11849"],"ecosystem":"PyPI","epss":0.01126,"exploited":false,"fixed_versions":["1.11.0"],"ghsa_id":"GHSA-rmjr-87wv-gf87","id":"tcs_01M5KGTK9JQPBD5F4FVA10M47F","modified_at":"2026-07-07T17:46:15.308467092Z","published_at":"2026-07-07T16:03:07.843563Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1603","https://nvd.nist.gov/vuln/detail/CVE-2025-11849","https://github.com/mwilliamson/mammoth.js/commit/c54aaeb43a7941317c1f3c119ffa92090f988820","https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10","https://github.com/mwilliamson/java-mammoth","https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968","https://security.snyk.io/vuln/SNYK-JAVA-ORGZWOBBLEMAMMOTH-13561969","https://security.snyk.io/vuln/SNYK-JS-MAMMOTH-13554470","https://security.snyk.io/vuln/SNYK-PYTHON-MAMMOTH-13561967","https://pypi.org/project/mammoth","https://github.com/advisories/GHSA-rmjr-87wv-gf87"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1603","url":"https://osv.dev/vulnerability/PYSEC-2026-1603"}],"summary":"Mammoth is vulnerable to Directory Traversal"}