{"id":"CVE-2025-58769","aliases":["GHSA-9mh6-g99m-ppcw"],"url":"https://o3.security/vulnerability/CVE-2025-58769","summary":"auth0-PHP: Improper File Type Handling in Bulk User Import","details":"### Overview\nIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.\n\n### Am I affected?\nYou are affected by this vulnerability if you meet the following preconditions:\n1. Applications using the Auth0-PHP SDK, versions between v3.3.0 and v8.16.0, or\n2. Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v3.3.0 and v8.16.0:\na. Auth0/symfony,\nb. Auth0/laravel-auth0,\nc. Auth0/wordpress.\n\n### Fix\nUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater.\n\n### Acknowledgement\nOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.","published":"2025-10-01T19:57:05.692Z","modified":"2026-10-28T02:30:35.186982469Z","cvss":{"score":3.3,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.0035,"percentile":0.28552,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"auth0/auth0-php","fixedVersion":"8.17.0"}],"fix":{"url":"https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c","label":"auth0/auth0-PHP@9026da5"},"references":[{"type":"WEB","url":"https://github.com/auth0/auth0-PHP/releases/tag/8.17.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58769.json"},{"type":"ADVISORY","url":"https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw"},{"type":"ADVISORY","url":"https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24"},{"type":"ADVISORY","url":"https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432"},{"type":"ADVISORY","url":"https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58769"},{"type":"FIX","url":"https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c"},{"type":"PACKAGE","url":"https://github.com/auth0/auth0-PHP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:35.186982469Z"}}