CVE-2025-13265

Name of the Vulnerable Software and Affected Versions lsfusion platform versions prior to 6.1

Description A flaw exists in the lsfusion platform that allows for path traversal. This issue is related to the unpackFile function located in the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. The manipulation of this function can lead to unauthorized access. This attack can be initiated remotely.

Recommendations Update to a version of lsfusion platform greater than 6.1. As a temporary workaround, consider restricting access to the unpackFile function until a patch is available.