CVE-2025-67845: Mintlify Path Traversal Vulnerability

CVE-2025-67845 Overview

CVE-2025-67845 is a directory traversal vulnerability [CWE-24] in the Static Asset Proxy Endpoint of the Mintlify Platform. Versions released before 2025-11-15 are affected. Remote attackers can inject arbitrary web script or HTML by crafting URLs that contain path traversal sequences. Successful exploitation delivers cross-site scripting (XSS) payloads through the trusted Mintlify origin, which host documentation sites for many software vendors.

The flaw requires low privileges and user interaction, and its scope change allows impact across trust boundaries. Mintlify published remediation guidance in its November 2025 security researcher blog post.

Critical Impact
Attackers can abuse the asset proxy to serve attacker-controlled HTML or JavaScript from a trusted Mintlify-hosted domain, enabling XSS against documentation visitors.

Affected Products

Mintlify Platform versions released before 2025-11-15
Documentation sites hosted on the Mintlify Platform using the Static Asset Proxy Endpoint
Downstream customer domains relying on Mintlify-hosted assets

Discovery Timeline

2025-12-19 - CVE-2025-67845 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67845

Vulnerability Analysis

The vulnerability resides in Mintlify's Static Asset Proxy Endpoint. This endpoint fetches and relays static assets referenced by documentation pages. The proxy fails to normalize or validate request paths before resolving them. An attacker can submit a URL containing ../ or encoded traversal sequences to escape the intended asset directory.

Because the proxy returns the fetched content under a Mintlify-controlled origin, the browser executes any HTML or JavaScript payload within that origin's security context. The scope change reflected in the CVSS vector maps to this cross-origin trust impact. Visitors to the targeted documentation site inherit the risk, including session cookies and tokens bound to the hosting domain.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-24]. The proxy accepts user-supplied path segments without canonicalizing them or enforcing an allow-list of permitted asset locations. Content-type handling further compounds the issue because arbitrary resources returned through the proxy are rendered rather than treated as opaque downloads.

Attack Vector

Exploitation is remote and network-based. An attacker crafts a URL referencing the asset proxy with path traversal sequences that resolve to attacker-controlled HTML or script content. The attacker then shares the link through phishing, forums, or social channels. When a victim clicks the link, the proxy serves the payload under the trusted documentation origin, triggering the XSS condition.

No verified proof-of-concept code is published. For technical commentary, see the Kibty blog post on Mintlify and the related Hacker News discussion.

Detection Methods for CVE-2025-67845

Indicators of Compromise

Proxy requests containing ../, ..%2f, ..%5c, or double-encoded traversal sequences in the asset path
Responses from the Static Asset Proxy Endpoint with Content-Type: text/html or application/javascript when image or font assets were expected
Outbound referrals from Mintlify-hosted documentation pages to unexpected third-party domains
Unusual spikes in asset proxy traffic tied to a single referring page or campaign URL

Detection Strategies

Inspect web server and CDN logs for proxy URLs containing path traversal patterns and alert on anomalous query strings
Deploy Content Security Policy (CSP) reporting to surface script execution from unapproved sources on documentation domains
Correlate browser-reported CSP violations with user navigation to flag active exploitation attempts
Review HTTP response payloads sampled from the proxy for unexpected <script> tags or inline event handlers

Monitoring Recommendations

Enable continuous logging of all Static Asset Proxy requests, including full URL, referrer, and response content type
Monitor for sudden increases in 200-status proxy responses serving HTML content
Alert on documentation page views immediately preceded by proxy requests with suspicious encoded characters
Track user reports of unexpected popups, redirects, or credential prompts on Mintlify-hosted sites

How to Mitigate CVE-2025-67845

Immediate Actions Required

Confirm your Mintlify Platform deployment is updated to the fixed release referenced in the Mintlify November 2025 advisory
Review the Mintlify Documentation Changelog for version details and apply any pending platform updates
Audit CDN and proxy logs from before 2025-11-15 for traversal patterns indicative of prior exploitation
Rotate any session tokens or API keys that may have been exposed through XSS on affected documentation domains

Patch Information

Mintlify addressed the vulnerability in platform updates released on or after 2025-11-15. The vendor documented its coordinated response in the working with security researchers blog post. Customers using Mintlify's hosted platform receive the fix automatically; self-managed or embedded deployments must verify the running build.

Workarounds

Enforce a strict Content Security Policy on documentation domains to block inline scripts and restrict script sources to known origins
Configure web application firewall (WAF) rules to reject requests containing path traversal sequences in asset proxy paths
Serve static assets from a sandboxed subdomain isolated from authenticated application cookies
Educate users to avoid clicking documentation URLs with abnormal path structures or encoded characters

bash

# Example WAF rule pattern to block traversal sequences in asset proxy requests
# Pseudocode - adapt syntax to your WAF vendor
if request.path matches "/proxy/" and request.uri contains any of ("../", "..%2f", "..%5c", "%2e%2e/"):
    action: block
    log: true
    alert: "CVE-2025-67845 traversal attempt"