GHSA-hjfh-5jmm-xr24: 
PHP vulnerability analysis and mitigation

The vulnerability (CVE-2025-58769) affects the Auth0-PHP SDK's Bulk User Import endpoint, specifically in versions 3.3.0 through 8.16.0. The issue stems from improper file-path wrapper and value validation, which could allow applications to accept arbitrary file paths or URLs. This vulnerability impacts applications using either the Auth0-PHP SDK directly or indirectly through Auth0/symfony, Auth0/laravel-auth0 (versions 4.0.0 to 7.18.0), or Auth0/wordpress SDKs (GitHub Advisory, NVD).

The vulnerability is classified with a CVSS v3.1 base score of 3.3 (Low severity) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. This indicates a network-accessible vulnerability with high attack complexity and high privileges required, requiring no user interaction, with unchanged scope and low impact on confidentiality and integrity, but no impact on availability. The vulnerability is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type) and involves improper handling of file types in the Bulk User Import functionality (GitHub Advisory).

The vulnerability could potentially allow attackers to upload or transfer files of dangerous types that can be automatically processed within the product's environment, potentially leading to unauthorized access to data or system compromise. The impact is considered low severity due to the high attack complexity and high privileges required for exploitation (GitHub Advisory).

The vulnerability has been patched in Auth0-PHP SDK version 8.17.0 and Laravel-Auth0 SDK version 7.19.0. Users are strongly advised to upgrade to these or later versions to address the security issue. The fix includes proper validation of file-path wrappers and values in the Bulk User Import endpoint (GitHub Release, GitHub Commit).

The vulnerability was discovered and reported by Mohamed Amine Saidani (pwni), with acknowledgment from Okta. The disclosure and patching process was handled through coordinated efforts between Auth0 and the security researcher (GitHub Advisory).