CVE-2025-25223

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M LuxCal Web Calendar versions prior to 5.3.3L

Description: The issue concerns a path traversal vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on a server.

Recommendations: For versions prior to 5.3.3M, update to version 5.3.3M or later. For versions prior to 5.3.3L, update to version 5.3.3L or later. As a temporary workaround, consider restricting access to the dloader.php file until a patch is available.