PT-2025-47120 · Unknown · Lsfusion Platform

R1Ckyz · Published 2025-11-17 · Updated 2025-12-01 · CVE-2025-13265

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions lsfusion platform versions prior to 6.1

Description A flaw exists in the lsfusion platform that allows for path traversal. This issue is related to the unpackFile function located in the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. The manipulation of this function can lead to unauthorized access. This attack can be initiated remotely.

Recommendations Update to a version of lsfusion platform greater than 6.1. As a temporary workaround, consider restricting access to the unpackFile function until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13265

GHSA-8WF8-FRJG-XV74

Affected Products

Lsfusion Platform

References · 12

• https://github.com/lsfusion/platform/issues/1545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wf8-frjg-xv74 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13265 · Security Note
• https://github.com/lsfusion/platform · Note
• https://twitter.com/CVEnew/status/1990296851153604627 · Twitter Post
• https://vuldb.com/?id.332600 · Note
• https://vuldb.com/?ctiid.332600 · Note
• https://t.me/cveNotify/142974 · Telegram Post
• https://t.me/cveNotify/144424 · Telegram Post
• https://t.me/CVEtracker/37471 · Telegram Post
• https://vuldb.com/?submit.689427 · Note