CVE-2025-48050 Details
Description
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
A directory traversal vulnerability has been identified in DOMPurify versions through 3.2.5, specifically within the 'scripts/server.js' file. The issue arises because the script does not properly validate user-controlled data when constructing file paths, allowing access to files outside the intended directory. This vulnerability could be exploited to read sensitive information or modify files by navigating the file system using '../' sequences. Although the vulnerability exists in a development helper script that must be manually started, it has been reported as a high-severity issue by a third party.
Users can update to DOMPurify version 3.2.6, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2025CISA-ADP
Assessed May 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/pull/1101 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/cure53/DOMPurify/commit/6bc6d60e49256f27a4022181b7d8a5b0721fd534 | [email protected] | Source CodeVendor |
| https://github.com/cure53/DOMPurify/pull/1101 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/odaysec/advisory/blob/main/cure53/DOMPurify/writeup.md | [email protected] | Technical Analysis |
| https://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060 | [email protected] | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-24 | Path Traversal: '../filedir' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 DOMPurify | <= 3.2.5 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 16, 2025 | CVE Modified | [email protected] |
| May 16, 2025 | CVE Modified | [email protected] |
| May 15, 2025 | CVE Modified | CISA-ADP |
| May 15, 2025 | New CVE Received | [email protected] |