Back to Database
Status published
Medium
CVE-2025-67842
The Static Asset API in Mintlify Platform before 2025-11-15 allows...
Vulnerability Description
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67842
Credits & Attribution
No credits recorded in the NVD database.
References
More from Mintlify
View All →CVE-2025-67846
The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote...
Medium
4.9
CVE-2025-67845
A Directory Traversal vulnerability in the Static Asset Proxy Endpoint...
Medium
6.4
CVE-2025-67844
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows...
Medium
5
CVE-2025-67843
A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering...
High
8.3
Affected Vendor
Mintlify
View all reports →Affected Software
Mintlify Platform
Vulnerable Versions:
0
Timeline
Official Publish:
December 19th, 2025
Last Modified:
December 23rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.