CVE-2025-64712: Unstructured Path Traversal in partition_msg Allows Arbitrary File Write
CVE-2025-64712 is a path traversal vulnerability in the partition_msg function of the Unstructured open-source document processing library, affecting versions before 0.18.18. According to the record, a crafted MSG file with attachments can be used to write or overwrite arbitrary files on the filesystem. The issue is fixed in version 0.18.18, and the record rates it critical with CVSS 3.1 score 9.8.
Overview
CVE-2025-64712 affects the Unstructured library, which provides open-source components for ingesting and pre-processing images and text documents such as PDFs, HTML and Word files. The weakness is classified as CWE-22 (Path Traversal) and lies in the partition_msg function, which handles MSG files.
Impact
According to the record, a malicious MSG file with attachments can cause the library to write or overwrite arbitrary files on the filesystem. The record assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable issue requiring no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated high in that vector.
Affected products and versions
- Product listed as Unstructured Unstructured, versions before 0.18.18 (< 0.18.18).
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. EPSS data is not present in the record.
Remediation and mitigation
- Upgrade the unstructured library to version 0.18.18 or later, which the record identifies as the patched release.
- Review the vendor advisory GHSA-gm8q-m8mv-jj5m for the mitigation guidance it provides.
- Consult the patch commit to confirm the change applied.
- Until upgraded, limit processing of untrusted MSG files and run document ingestion with restricted filesystem write permissions, as a defensive measure.
Detection guidance
- Inventory systems and container images that use the unstructured package and record installed versions.
- Flag any installation below 0.18.18 for prioritized update.
- Monitor ingestion pipelines for unexpected file creation or modification outside expected output directories.
Limitations of the available information
The record does not include a vendor-specified product name beyond the affected entry, a separate CNA-published CVSS source, EPSS or SSVC data, or a KEV entry. Whether other deployment configurations are affected beyond what the version range states is unknown from the record.
Frequently asked questions
Which versions of Unstructured are affected by CVE-2025-64712?
The record lists versions before 0.18.18 as affected.
Is CVE-2025-64712 known to be actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Upgrade the unstructured package to version 0.18.18 or later and review the vendor advisory referenced in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.