CVE-2025-58769: auth0-PHP: Improper File Type Handling in Bulk User Import
Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0-PHP SDK, versions between v3.3.0 and v8.16.0, or 2. Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v3.3.0 and v8.16.0: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress.
Fix Upgrade Auth0/Auth0-PHP to version 8.17.0 or greater.
Acknowledgement Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
Other sources
auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58769?
CVE-2025-58769 has a medium severity due to its potential for arbitrary file acceptance without validation.
How do I fix CVE-2025-58769?
To fix CVE-2025-58769, upgrade the auth0-PHP SDK to a version later than 8.16.0.
What versions of auth0-PHP are affected by CVE-2025-58769?
CVE-2025-58769 affects auth0-PHP versions from 3.3.0 to 8.16.0 inclusive.
What is the main issue with CVE-2025-58769?
The main issue with CVE-2025-58769 is the lack of file-path validation in the Bulk User Import endpoint.
How can CVE-2025-58769 impact my application?
CVE-2025-58769 may allow malicious users to exploit the vulnerability and manipulate file paths leading to potential unauthorized file access.