Directory Traversal Vulnerability in Mastra Framework by Mastra AI

CVE-2025-61685

What is CVE-2025-61685?

The Mastra framework has a vulnerability that allows attackers to exploit a Directory Traversal issue, leading to unauthorized access to sensitive directory listings. This is due to a flawed logic in the security checks designed to prevent path traversal, which can be bypassed during the directory suggestion process. Attackers can leverage this vulnerability to reveal the contents of arbitrary directories on the victim's filesystem, including sensitive information stored within the user's home directory. It is crucial for users of versions 0.13.8 to 0.13.20-alpha.0 to upgrade to version 0.13.20 to mitigate this risk.

References