Improper File Type Handling in Bulk User Import in laravel-auth0 SDK CVE-2025-58769 - Oct 1, 2025

Description

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Affected versions

You are affected if you meet the following preconditions:

Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for their discovery.

CVE details

CVE ID	CVE-2025-58769
Published Date	2025-10-01
Vulnerability Type	Unrestricted File Upload
CWE	CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSS v3	Score: 3.3 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

Improper File Type Handling in Bulk User Import in laravel-auth0 SDK