CVE-2025-58769: auth0-PHP SDK Arbitrary File Path Vulnerability in Bulk User Import
Summary
CVE-2025-58769: auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import. Affects auth0/auth0-php versions >= 3.3.0, < 8.17.0. Fixed in 8.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Auth0-PHP is a popular SDK used for integrating Auth0 authentication services into PHP applications. It provides developers with tools to manage user authentication, authorization, and user management features seamlessly. However, versions between 3.3.0 and 8.16.0 are vulnerable to a critical issue where the Bulk User Import endpoint fails to validate file paths, allowing potential exploitation.
Vulnerability Detail
The vulnerability arises from the Bulk User Import endpoint in the Auth0-PHP SDK, which does not properly validate file path wrappers or values. This oversight can lead to the acceptance of arbitrary file paths or URLs, potentially allowing an attacker to manipulate file imports and access sensitive data. The affected versions include those from 3.3.0 to 8.16.0, and it can impact applications using related SDKs such as Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress.
How To Fix
Minimum fixed version
8.17.0
This is the first release that contains the fix.
composer require auth0/auth0-php:8.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on the file paths before they are processed by the Bulk User Import endpoint. This can be done by checking the file path against a whitelist of allowed paths or by sanitizing the input to prevent malicious entries.
Conclusion
The CVE-2025-58769 vulnerability in the Auth0-PHP SDK poses a risk to applications that utilize the Bulk User Import endpoint. It is crucial for developers to upgrade to version 8.17.0 or higher to mitigate this risk. Implementing additional validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for auth0/auth0-php →
FAQ
CVE-2025-58769 is a vulnerability in the Auth0-PHP SDK that allows arbitrary file paths to be accepted in the Bulk User Import endpoint, potentially leading to unauthorized access.
Versions of Auth0-PHP between 3.3.0 and 8.16.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, implement additional validation on file paths as a temporary workaround to mitigate the risk.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/auth0-php.
