CVE-2025-67842 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because a…
Medium CVSS: 6.4

CVE-2025-67842

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
Vendor
Mintlify
Product
Mintlify
CWE
CWE-829
Yayın Tarihi
2025-12-19 02:16:08
Güncelleme
2026-01-02 16:01:50
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-829 Mintlify MEDIUM Mintlify 2025

Referanslar

https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28 https://heartbreak.ing https://kibty.town/blog/mintlify/ https://news.ycombinator.com/item?id=46317098 https://www.mintlify.com/blog/working-with-security-researchers-november-2025 https://www.mintlify.com/docs/changelog https://kibty.town/blog/mintlify/