CVE-2025-13265CWE-22path-traversal

CVE-2025-13265

Medium · published November 17, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-17T11:15Z
Affected products (1)
ProductVersionsFixed in
lsfusion/lsfusion_platform≤ 6.1—
References (4)
https://github.com/lsfusion/platform/issues/1545 · [email protected]https://vuldb.com/?ctiid.332600 · [email protected]https://vuldb.com/?id.332600 · [email protected]https://vuldb.com/?submit.689427 · [email protected]
EPSS history
Timeline
  • 17 NOV 05:32Z
    lsfusion platform ZipUtils.java unpackFile path traversal
    cvelistv5