CVE-2025-67845

Medium · 5.4

CVSS

5.4

EPSS

0.5%

Published

Dec 19, 2025

CISA due date

—

The record

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.

Affected packages

Ecosystem	Package	Introduced	Fixed