216.73.217.86

CVE-2025-54387

· Published 05/08/2025 01:15 · Modified 05/08/2025 14:34

Labels: CVE-2025-54387 2025-08-05CVE-2025-54387CWE-22[email protected]

Essential information

Published
05/08/2025 01:15
Modified
05/08/2025 14:34
Author
—
Creator
—
CVSS
6.9 MEDIUM (v3) 6.9 MEDIUM (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.

NVD status

Status
Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
github / ipx cpe:2.3:a:github:ipx:1.3.1:*:*:*:*:*:*:*
github / ipx cpe:2.3:a:github:ipx:<2.0.0-0:<2.1.0:*:*:*:*:*:*
github / ipx cpe:2.3:a:github:ipx:3.0.0-3.1.0:*:*:*:*:*:*

References