GHSA-9rvm-p3qm-f4vv

Smidge is vulnerable to Path Traversal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-11842

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Smidge	< 4.6.0	4.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-11842 advisory
https://github.com/Shazwazza/Smidge package
https://github.com/Shazwazza/Smidge/releases/tag/v4.6.0 web
https://github.com/asust9/smidge-vuln?tab=readme-ov-file web
https://vuldb.com/?id.328776 web
https://vuldb.com/?submit.664905 web