CVE-2025-11849: Mammoth Path Traversal Vulnerability

CVE-2025-11849 Overview

CVE-2025-11849 is a Directory Traversal vulnerability affecting the Mammoth document conversion library across multiple programming language implementations. The vulnerability exists in versions from 0.3.25 and before 1.11.0, allowing attackers to read arbitrary files on systems where document conversion is performed. The flaw stems from insufficient path and file type validation when processing docx files containing images with external links.

Critical Impact

Attackers can read arbitrary sensitive files on the target system or cause resource exhaustion by crafting malicious docx files that link to special device files such as /dev/random or /dev/zero.

Affected Products

• mammoth (JavaScript/npm) versions from 0.3.25 to before 1.11.0
• mammoth (Python/PyPI) versions from 0.3.25 to before 1.11.0
• mammoth (.NET/NuGet) versions from 0.3.25 to before 1.11.0
• org.zwobble.mammoth:mammoth (Java/Maven) versions before 1.11.0

Discovery Timeline

• 2025-10-17 - CVE-2025-11849 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-11849

Vulnerability Analysis

This Directory Traversal vulnerability (CWE-22) occurs in the Mammoth library's handling of external file references within docx documents. When processing a docx file, the library reads images and other resources that may be referenced either as embedded content (using the r:embed attribute) or as external links (using the r:link attribute). The vulnerability arises because the library did not properly validate or restrict external file paths before resolving and reading them.

When a malicious docx file contains an image reference with an r:link attribute pointing to a local file path, the library resolves this URI to an absolute file path on the system. The content is then read, base64-encoded, and included directly in the HTML output as a data URI. This behavior enables an attacker to exfiltrate arbitrary file contents through the converted HTML output.

Additionally, attackers can exploit this flaw to cause denial of service conditions by crafting docx files that reference special device files like /dev/random or /dev/zero, potentially causing excessive resource consumption or system hangs.

Root Cause

The root cause is the lack of path validation and file type restrictions when the library processes external file references in docx documents. The externalFileAccess option was enabled by default (true), allowing the library to read any file accessible to the process without restricting access to sensitive system paths or device files.

Attack Vector

The attack requires user interaction where a victim must process a maliciously crafted docx file using the vulnerable Mammoth library. The attacker crafts a docx file containing image references with r:link attributes pointing to sensitive local files (e.g., /etc/passwd, configuration files, or application secrets). When the victim's application converts this document to HTML, the referenced files are read and their contents are embedded in the output.

The security patch disables external file access by default, as shown in the following code changes:

* Ignore style definitions using a style ID that has already been used.

-* Support disabling external file accesses using the externalFileAccess option.
+* Disable external file accesses by default. External file access can be enabled
+  using the externalFileAccess option.

* Handle numbering levels defined without an index.

Source: GitHub Commit Note

The implementation change in lib/options-reader.js:

];

var standardOptions = exports._standardOptions = {
-    externalFileAccess: true,
+    externalFileAccess: false,
    transformDocument: identity,
    includeDefaultStyleMap: true,
    includeEmbeddedStyleMap: true

Source: GitHub Commit Note

Detection Methods for CVE-2025-11849

Indicators of Compromise

• Unusual file access patterns from document conversion processes, particularly reads of sensitive system files
• Docx files containing r:link attributes referencing local file paths outside expected directories
• HTML output containing unexpectedly large base64-encoded data URIs
• Process crashes or hangs when converting docx files (indicating attempts to read device files)

Detection Strategies

• Monitor file system access from applications using Mammoth library for reads to sensitive paths like /etc/, /proc/, or application configuration directories
• Implement content inspection on uploaded docx files to detect r:link attributes with suspicious file path references
• Review converted HTML output for unexpected base64-encoded content that may indicate file exfiltration
• Use application-level logging to track document conversion operations and correlate with file access events

Monitoring Recommendations

• Enable detailed file access logging for processes running document conversion services
• Implement alerts for document conversion processes accessing files outside expected working directories
• Monitor for unusual resource consumption patterns that may indicate attempts to read infinite streams from device files
• Track and audit all docx files processed by applications using Mammoth library in production environments

How to Mitigate CVE-2025-11849

Immediate Actions Required

• Update Mammoth library to version 1.11.0 or later across all affected platforms (JavaScript, Python, .NET, Java)
• Review applications for any explicit externalFileAccess: true configurations and remove unless absolutely necessary
• Audit recently processed docx files for potential exploitation attempts
• Implement additional file validation before processing untrusted documents

Patch Information

The vulnerability has been addressed in Mammoth version 1.11.0, which disables external file access by default. The fix is available for all affected language implementations:

• JavaScript: Update via npm to version 1.11.0 or later
• Python: Update via pip to version 1.11.0 or later
• .NET: Update via NuGet to version 1.11.0 or later
• Java: Update org.zwobble.mammoth:mammoth to version 1.11.0 or later

For detailed vulnerability information by platform, see the Snyk JavaScript Vulnerability, Snyk Python Vulnerability, Snyk .NET Vulnerability, and Snyk Java Vulnerability advisories.

Workarounds

• If immediate upgrade is not possible, explicitly set externalFileAccess: false in the Mammoth options configuration
• Run document conversion processes in sandboxed environments with restricted file system access
• Implement input validation to reject docx files containing r:link attributes before processing
• Use containerization or chroot to limit accessible file paths for conversion processes

# Example: Running conversion in a restricted container
docker run --read-only \
  --security-opt=no-new-privileges \
  --tmpfs /tmp:noexec,nosuid,nodev \
  -v /app/uploads:/uploads:ro \
  mammoth-converter:latest