PT-2025-52403

CVE-2025-67842

Published

2025-12-18

Updated

2025-12-19

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15

Description The Static Asset API in Mintlify Platform is susceptible to a cross-tenant asset injection issue. This allows remote attackers to inject arbitrary web script or HTML through manipulation of the subdomain parameter. Specifically, assets belonging to one tenant can be served on another tenant's documentation site.

Recommendations Update Mintlify Platform to version 2025-11-15 or later.

Exploitability

Exploit

Fix

Researchers

Hackermon

Mdl

Vendors

Affected products

Weakness enumeration

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related identifiers