PT-2025-16262 · Avantfax+1 · Avantfax+1

Fabian Beskow · Published 2025-02-21 · Updated 2026-05-26 · CVE-2025-1782

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HylaFAX Enterprise Web Interface and AvantFAX (affected versions not specified)

Description The language form element in HylaFAX Enterprise Web Interface and AvantFAX is not properly sanitized before being used, allowing an attacker to include an arbitrary file in the PHP code. This enables the attacker to perform any action as the web server user. The flaw requires the attacker to be authenticated with a valid user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-09789

CVE-2025-1782

Affected Products

Avantfax

Hylafax Enterprise Web Interface

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-1782 · Security Note
• https://bdu.fstec.ru/vul/2025-09789 · Security Note
• https://twitter.com/CCBalert/status/1912165241099542699 · Twitter Post
• https://twitter.com/cybercronai/status/1912423384580759856 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1913160969292759320 · Twitter Post
• https://vuldb.com/?id.304656 · Note
• https://twitter.com/syedaquib77/status/1912335955085709675 · Twitter Post
• https://ifax.com/security/CVE-2025-1782.html · Note
• https://t.me/cvetracker/21559 · Telegram Post
• https://twitter.com/CveFindCom/status/1911857689841279080 · Twitter Post
• https://t.me/cvedetector/22885 · Telegram Post
• https://twitter.com/CVEnew/status/1911854983227822498 · Twitter Post
• https://t.me/cveNotify/164737 · Telegram Post
• https://t.me/purp_sec/614 · Telegram Post