CVE-2025-11849: Mammoth Path Traversal Vulnerability

CVE-2025-11849 Overview

CVE-2025-11849 is a Directory Traversal vulnerability affecting the Mammoth document conversion library across multiple programming language implementations. The vulnerability exists in versions from 0.3.25 and before 1.11.0, allowing attackers to read arbitrary files on systems where document conversion is performed. The flaw stems from insufficient path and file type validation when processing docx files containing images with external links.

Critical Impact
Attackers can read arbitrary sensitive files on the target system or cause resource exhaustion by crafting malicious docx files that link to special device files such as /dev/random or /dev/zero.

Affected Products

mammoth (JavaScript/npm) versions from 0.3.25 to before 1.11.0
mammoth (Python/PyPI) versions from 0.3.25 to before 1.11.0
mammoth (.NET/NuGet) versions from 0.3.25 to before 1.11.0
org.zwobble.mammoth:mammoth (Java/Maven) versions before 1.11.0

Discovery Timeline

2025-10-17 - CVE-2025-11849 published to NVD
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-11849

Vulnerability Analysis

This Directory Traversal vulnerability (CWE-22) occurs in the Mammoth library's handling of external file references within docx documents. When processing a docx file, the library reads images and other resources that may be referenced either as embedded content (using the r:embed attribute) or as external links (using the r:link attribute). The vulnerability arises because the library did not properly validate or restrict external file paths before resolving and reading them.

When a malicious docx file contains an image reference with an r:link attribute pointing to a local file path, the library resolves this URI to an absolute file path on the system. The content is then read, base64-encoded, and included directly in the HTML output as a data URI. This behavior enables an attacker to exfiltrate arbitrary file contents through the converted HTML output.

Additionally, attackers can exploit this flaw to cause denial of service conditions by crafting docx files that reference special device files like /dev/random or /dev/zero, potentially causing excessive resource consumption or system hangs.

Root Cause

The root cause is the lack of path validation and file type restrictions when the library processes external file references in docx documents. The externalFileAccess option was enabled by default (true), allowing the library to read any file accessible to the process without restricting access to sensitive system paths or device files.

Attack Vector

The attack requires user interaction where a victim must process a maliciously crafted docx file using the vulnerable Mammoth library. The attacker crafts a docx file containing image references with r:link attributes pointing to sensitive local files (e.g., /etc/passwd, configuration files, or application secrets). When the victim's application converts this document to HTML, the referenced files are read and their contents are embedded in the output.

The security patch disables external file access by default, as shown in the following code changes:

text

* Ignore style definitions using a style ID that has already been used.

-* Support disabling external file accesses using the externalFileAccess option.
+* Disable external file accesses by default. External file access can be enabled
+  using the externalFileAccess option.

* Handle numbering levels defined without an index.

Source: GitHub Commit Note

The implementation change in lib/options-reader.js:

javascript

];

var standardOptions = exports._standardOptions = {
-    externalFileAccess: true,
+    externalFileAccess: false,
    transformDocument: identity,
    includeDefaultStyleMap: true,
    includeEmbeddedStyleMap: true

Source: GitHub Commit Note

Detection Methods for CVE-2025-11849

Indicators of Compromise

Unusual file access patterns from document conversion processes, particularly reads of sensitive system files
Docx files containing r:link attributes referencing local file paths outside expected directories
HTML output containing unexpectedly large base64-encoded data URIs
Process crashes or hangs when converting docx files (indicating attempts to read device files)

Detection Strategies

Monitor file system access from applications using Mammoth library for reads to sensitive paths like /etc/, /proc/, or application configuration directories
Implement content inspection on uploaded docx files to detect r:link attributes with suspicious file path references
Review converted HTML output for unexpected base64-encoded content that may indicate file exfiltration
Use application-level logging to track document conversion operations and correlate with file access events

Monitoring Recommendations

Enable detailed file access logging for processes running document conversion services
Implement alerts for document conversion processes accessing files outside expected working directories
Monitor for unusual resource consumption patterns that may indicate attempts to read infinite streams from device files
Track and audit all docx files processed by applications using Mammoth library in production environments

How to Mitigate CVE-2025-11849

Immediate Actions Required

Update Mammoth library to version 1.11.0 or later across all affected platforms (JavaScript, Python, .NET, Java)
Review applications for any explicit externalFileAccess: true configurations and remove unless absolutely necessary
Audit recently processed docx files for potential exploitation attempts
Implement additional file validation before processing untrusted documents

Patch Information

The vulnerability has been addressed in Mammoth version 1.11.0, which disables external file access by default. The fix is available for all affected language implementations:

JavaScript: Update via npm to version 1.11.0 or later
Python: Update via pip to version 1.11.0 or later
.NET: Update via NuGet to version 1.11.0 or later
Java: Update org.zwobble.mammoth:mammoth to version 1.11.0 or later

For detailed vulnerability information by platform, see the Snyk JavaScript Vulnerability, Snyk Python Vulnerability, Snyk .NET Vulnerability, and Snyk Java Vulnerability advisories.

Workarounds

If immediate upgrade is not possible, explicitly set externalFileAccess: false in the Mammoth options configuration
Run document conversion processes in sandboxed environments with restricted file system access
Implement input validation to reject docx files containing r:link attributes before processing
Use containerization or chroot to limit accessible file paths for conversion processes

bash

# Example: Running conversion in a restricted container
docker run --read-only \
  --security-opt=no-new-privileges \
  --tmpfs /tmp:noexec,nosuid,nodev \
  -v /app/uploads:/uploads:ro \
  mammoth-converter:latest