Improper File Type Handling in Bulk User Import in Auth0 Symfony SDK CVE-2025-58769 - Oct 1, 2025

Description

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Affected versions

You are affected if you meet the following preconditions:

Applications using the Auth0 Symfony SDK with versions >=2.0.2 and <=5.4.1,
Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0/symfony to version 5.5.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for their discovery.

CVE details

CVE ID	CVE-2025-58769
Published Date	2025-10-01
Vulnerability Type	Unrestricted File Upload
CWE	CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSS v3	Score: 3.3 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

Improper File Type Handling in Bulk User Import in Auth0 Symfony SDK