CVE-2025-32807

Medium CVSS: 5.3

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

Vendor

Product

CWE

CWE-24

Yayın Tarihi

2025-04-11 00:15:27

Güncelleme

2025-04-11 15:39:52

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-24 MEDIUM 2025

Referanslar

https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/blob/e9304844fb5c8ce4a9af9e26858af5e22e15b9bd/Changelog.md?plain=1#L112 https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/blob/e9304844fb5c8ce4a9af9e26858af5e22e15b9bd/include/class_IconTheme.inc#L233-237 https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/commit/9edefd0b367450d665a141c5e94db8a06d208556