CVE-2025-58769
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import
Description
### Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. ### Am I affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0, 2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0. ### Fix Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater. ### Acknowledgement Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
How to fix CVE-2025-58769
To remediate CVE-2025-58769, upgrade the affected package to a fixed version below.
- —upgrade to 8.17.0 or later
- —upgrade to 7.19.0 or later
- —upgrade to 5.5.0 or later
Is CVE-2025-58769 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- >= 3.3.0, < 8.17.0
- >= 4.0.0, < 7.19.0
- >= 2.0.2, < 5.5.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.3 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N |