CVE-2025-64712
CRITICAL
GHSA-gm8q-m8mv-jj5m
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to version 0.18.18, a path traversal vulnerability in the partition_msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. This issue has been patched in version 0.18.18.
Analysis
The unstructured Python library for document ingestion has a path traversal vulnerability allowing arbitrary file read/write during document processing.
Technical Context
The unstructured library has a CWE-22 path traversal vulnerability that allows attackers to read or write arbitrary files on the server when processing crafted documents.
Affected Products
['unstructured Python library (before patch)']
Remediation
Update the unstructured library. Validate file paths during document processing.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today