Directory Traversal Vulnerability in DOMPurify Affects Software from Cure53

CVE-2025-48050

What is CVE-2025-48050?

A directory traversal vulnerability has been identified in the DOMPurify library, specifically in versions prior to 3.2.5. This vulnerability occurs because the library's scripts/server.js does not adequately validate pathnames, allowing unauthorized access to files outside the intended directory. Attackers could exploit this weakness to manipulate server requests, leading to potential data exposure or manipulation. It is crucial for users of DOMPurify to update to the latest version to mitigate these associated security risks.

References