MediumVulnerability
CVE-2025-61685: Mastra directory traversal disclosing directory listings
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-61685
- Published
- Record updated
- Affected
- @mastra/mcp-docs-server <= 0.13.8
- Fixed in
- 0.17.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
Mastra, a TypeScript framework for building AI agents and assistants, is vulnerable in versions 0.13.8 through 0.13.20-alpha.0 to directory traversal. A path traversal check that protects reading file contents is bypassed by later logic that generates directory suggestions, letting an attacker list arbitrary directories on the user's filesystem, including the home directory, and expose details of the file system's structure.
Mitigation
This issue is fixed in version 0.13.20.
Topics
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online