GitHub Advisoryadvisory · NuGet

GHSA-9rvm-p3qm-f4vv Smidge is vulnerable to Path Traversal

MEDIUM Published 2025-10-16 Modified 2025-10-16 Official page ↗
Aliases
CVE-2025-11842
Ecosystem
NuGet
Packages
Smidge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2025-10-16

Affected packages

• NuGet Smidge: < 4.6.0 → fixed in 4.6.0

Description

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2025-11842 A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References