CVE-2025-13262

Name of the Vulnerable Software and Affected Versions lsfusion platform versions prior to 6.1

Description A flaw exists in the lsfusion platform that allows for path traversal. This issue affects the UploadFileRequestHandler function located in the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Manipulation of the sid argument can lead to unauthorized access. The attack can be carried out remotely, and the exploit is publicly available.

Recommendations Versions prior to 6.1 should be updated. As a temporary workaround, consider restricting access to the UploadFileRequestHandler function until a patch is available.