A directory traversal vulnerability in the Mammoth library (all implementations) poses a critical risk of unauthorized file system interaction.

This vulnerability is a Directory Traversal flaw (CWE-22) affecting various language implementations of the Mammoth library. The issue allows an unauthenticated, remote attacker to manipulate file paths, potentially resulting in unauthorized file access or modification.

Successful exploitation allows an attacker to bypass file system restrictions, which can lead to the exposure of sensitive configuration files, source code, or internal data. Given the CVSS score of 9.3, this flaw represents a severe risk to data confidentiality and integrity, particularly for applications that process untrusted user-uploaded documents.

Immediate Action: Update all Mammoth library instances (npm, Maven, PyPI, NuGet) to version 1.11.0 or later immediately.

Proactive Monitoring: Monitor application logs for directory traversal patterns (e.g., "../" sequences) in input parameters associated with file processing.

Compensating Controls: Implement strict input validation and sanitization for any file paths or document processing routines to prevent path injection.

Public Exploit Available: No (exploit_available: unknown)

The high CVSS score and the existence of a PoC underscore the necessity of immediate patching. Organizations utilizing Mammoth in any capacity must prioritize updating to version 1.11.0 to eliminate this critical directory traversal vector.