Improper File Type Handling in Bulk User Import in auth0-PHP SDK CVE-2025-58769 - Oct 1, 2025

Description

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Affected versions

You are affected if you meet the following preconditions:

Applications using the Auth0-PHP SDK, versions between version 3.3.0 and version 8.16.0, or
Applications using the following SDKs that rely on the Auth0-PHP SDK versions between version 3.3.0 and version 8.16.0: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress.

Fix

Upgrade Auth0/Auth0-PHP to version 8.17.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for their discovery.

CVE details

CVE ID	CVE-2025-58769
Published Date	2025-10-01
Vulnerability Type	Unrestricted File Upload
CWE	CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSS v3	Score: 3.3 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

Improper File Type Handling in Bulk User Import in auth0-PHP SDK