CVE-2025-67842 MEDIUM

CVE-2025-67842

Vendor Mintlify
Product Mintlify Platform
Weakness CWE-829 · Inclusion from untrusted sphere
Published December 19, 2025
Last update December 23, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

Key dates

02Disclosure timeline

December 19, 2025 CVE published
December 23, 2025 Record updated