CVE-2025-13265 MEDIUM

CVE-2025-13265: lsfusion platform ZipUtils.java unpackFile path traversal

Vendor Lsfusion
Product platform
Weakness CWE-22 · Path traversal
Published November 17, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.

Key dates

02Disclosure timeline

November 17, 2025 CVE published
November 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVE-2026-15979 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion